No — a company generally cannot keep your credit card on file without permission, but “permission” is a broader concept than most people realize. It can be an obvious checkbox at checkout, or it can be a clause in the terms of service you accepted when you created an account. If a company stored or charged your card in a way you never actually agreed to, federal law caps your liability for unauthorized charges at $50, most card networks reduce that to zero, and you have a formal right to dispute the charge and demand the card be removed.
How Companies Claim They Have Your Permission
Consent to store a card comes in two flavors. Express consent is the checkbox, toggle, or button that specifically says the company will save your payment method. Implied consent is quieter: when you sign up for an account or complete a purchase, the terms of service you accepted usually include a clause authorizing the company to retain your payment data. Clicking “I Agree” counts as acceptance of every condition in that document, including the ones you scrolled past.
That is why “I never gave permission” is harder to prove than most people expect. Companies almost always have some form of consent on paper. The forgotten subscription, the unread terms, the checkbox left at its default — each creates a record. That does not mean the company can do anything it wants with your card. It means the practical question is usually not whether consent technically existed, but whether you want to revoke it now and reverse any charges you did not intend.
Before assuming the worst, log into the account in question and check the saved payment methods. Sometimes a card appears there because of a one-click option you tapped months ago and forgot.
How to Get Your Card Removed
You can revoke consent at any time and ask a company to delete your stored card. Start with self-service: log in, open the “payment methods” or “wallet” section, and remove the card yourself. If the site does not offer that option, email or call customer support and request deletion directly.
A few things trip people up here. Removing your card stops future charges but does not reverse charges already processed. If you have an active subscription, deleting the card does not cancel the subscription. You may still owe for the current billing period, and some companies will send the unpaid balance to collections. Cancel the subscription first, then remove the card. Companies may also retain transaction records — the fact that you paid, when, and how much — even after deleting the card number, because tax and accounting rules often require them to keep financial records for several years.
What to Do About an Unauthorized Charge
If a charge appears that you did not authorize, federal law limits how much you can be forced to pay. Under the Truth in Lending Act, your liability for unauthorized credit card use cannot exceed $50, and that amount only applies if the issuer met specific conditions like giving you notice of your potential liability and a way to report the problem.1eCFR. 12 CFR 1026.12 Special Credit Card Provisions Visa, Mastercard, and the other major networks go further with zero-liability policies that eliminate even that $50 for most consumer cards.
You also have the right to formally dispute the charge as a billing error. Send a written dispute to your card issuer within 60 days of the statement that first showed the charge. Once the issuer receives your notice, it has 30 days to acknowledge it and no more than 90 days to resolve the dispute. During the investigation, you can withhold payment on the disputed amount, and the issuer cannot report you as delinquent or send it to collections.2Office of the Law Revision Counsel. 15 USC 1666 Correction of Billing Errors
The 60-day deadline is the one that matters most. Missing it does not necessarily waive every right you have, but it significantly weakens your position. Dispute with the issuer first, then file complaints with regulators.
Debit Cards Have Weaker Protections
The rules above cover credit cards. Debit cards are governed by different rules with noticeably thinner protection. Report an unauthorized debit charge within two business days of discovering it, and your liability is capped at $50. Wait longer than two days but report within 60 days of your statement, and the cap jumps to $500. Miss the 60-day window, and you could be on the hook for the full amount of any unauthorized charges that occur after that deadline.3eCFR. 12 CFR Part 1005 Electronic Fund Transfers (Regulation E) The money also leaves your bank account immediately, which can cause cascading problems with rent and other bills while you wait for the investigation to finish. For cards you plan to store with merchants, a credit card usually leaves you in a stronger position than a debit card.
State Deletion Rights
A growing number of states have passed comprehensive data privacy laws that give you a formal, enforceable right to request deletion of personal information, including stored payment data. California’s Consumer Privacy Act is the most well-known. Under the CCPA, you can submit a deletion request through methods the business is required to provide, such as a toll-free number or a web form. The business has 45 calendar days to respond, with a possible 45-day extension, and it must direct its service providers to delete the same information.
California is not alone. As of 2026, roughly 20 states have comprehensive consumer privacy laws in effect, and most include some version of a right to delete. Response windows are typically 45 days under California-model laws and 30 days under Virginia-model laws. If you live in one of those states, a company that refuses a proper deletion request is not just being difficult — that refusal is a legal violation with potential penalties.
Where to File a Complaint
If the company will not resolve the problem directly, you have several places to escalate.
- Your card issuer. Call the number on the back of your card and initiate a formal dispute. This is the fastest way to get your money back, and federal law requires the issuer to investigate.4Federal Trade Commission. Using Credit Cards and Disputing Charges
- The Consumer Financial Protection Bureau. File a complaint at consumerfinance.gov/complaint about credit card issues, including unauthorized charges and improper data handling. The CFPB forwards complaints to the company and tracks the response.5Consumer Financial Protection Bureau. Submit a Complaint
- The Federal Trade Commission. The FTC does not resolve individual disputes, but reports help it identify patterns. Report fraud at ReportFraud.ftc.gov, or use IdentityTheft.gov if your payment data was compromised in a breach.6Federal Trade Commission. Data Breach Response: A Guide for Business
- Your state attorney general. In states with consumer privacy laws, the attorney general’s office typically handles enforcement, and many accept complaints through their websites.