How a saved payment method works
At the first payment, or when a card is added to an account, the customer agrees to the details being kept. The gateway exchanges the card number for a token and stores the token against the customer. Later payments are sent with the token and a flag that tells the issuer the credential was stored, and whether the customer or the merchant started the payment.
What the rules say about stored cards
The Visa Core Rules of 18 April 2026 define a stored credential as information, including a payment credential, that a merchant or its agent, a payment facilitator or a digital wallet operator stores to process future transactions. Before the first transaction, the merchant submits an authorisation request for the amount due or, where no payment is due, an account verification. If that request is not approved, the merchant does not store the credential (5.8.11.1).
The card security code is never part of a saved method. The PCI Security Standards Council's FAQ 1280 states that PCI DSS does not permit card verification codes to be kept once the transaction they were collected for has been authorised, card-on-file and recurring payments included.
Why saved payment methods matter
A saved method shortens checkout to one click, and is the basis of subscriptions and other merchant-initiated payments. Network tokens keep a saved card working when the card is reissued. A provider-neutral vault lets a merchant change processor without asking customers for their cards again.
Where a saved payment method shows up in a platform
Modules that do the work
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
Platforms that need it
Guides that go deeper
Where it is written
The laws and standards this page's facts come from.
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: 5.8.11.1 and the glossary, Stored Credential (Visa)
- PCI SSC, FAQ 1280: Can card verification codes/values be stored for card-on-file or recurring transactions?
General information, not legal advice: what applies to you depends on your services and your market.