A credit card authorization form for recurring payments is a written agreement that lets a merchant charge a cardholder’s account on a set schedule without seeking approval for each transaction. To be enforceable and compliant, the form has to capture specific card and billing information, spell out the terms the cardholder is agreeing to, follow Visa and Mastercard consent rules, meet the disclosure and cancellation requirements of the Restore Online Shoppers’ Confidence Act and the FTC’s Click-to-Cancel rule, and handle cardholder data under PCI DSS.
What the Form Must Contain
Two categories of information belong on the form: enough card data to process a card-not-present transaction, and enough billing detail that the cardholder knows exactly what they are consenting to.
On the card side, that means the cardholder’s full name as it appears on the card, the card number, and the expiration date. The three-digit security code (CVV on Visa, CVC on Mastercard) is collected for the initial verification only. PCI DSS Requirement 3.2 prohibits storing that code after the first authorization, so the form should never sit in a file with the code retained alongside the card number.1PCI Security Standards Council. FAQ: Can Card Verification Codes/Values Be Stored for Card-on-File or Recurring Transactions
On the billing side, the form needs to state the dollar amount of each charge (or how the amount will be calculated if it varies), the billing frequency, the date payments will be processed, and the duration of the agreement. A billing address and contact information round out the form and help prevent fraud flags at the processor.
Visa and Mastercard Consent Rules
Both major networks treat recurring billing terms as consumer disclosures, not fine print. Ignoring the rules exposes the merchant to chargebacks and network penalties.
Visa
Visa requires the cardholder’s express informed consent to an agreement that includes a description of the goods or services, the transaction amount or how it will be determined, the billing frequency and dates, cancellation and refund policies, and the length of any trial or promotional period. These terms must be displayed separately from general purchase terms and conditions at the moment consent is given.2Visa. Visa Core Rules and Visa Product and Service Rules
Visa also requires at least seven days’ advance notice before a recurring charge whenever a trial or promotional period is ending or the nature of the agreement has changed, such as a price increase or a shift in billing frequency. That notification must include a link or other simple way to cancel online.3Visa. Updated Policy for Subscription Merchants Offering Free Trials or Introductory Offers
Mastercard
Each time a recurring payment is authorized, Mastercard requires the merchant to send an electronic receipt that includes instructions for managing the account and canceling the subscription. For subscriptions with billing cycles of 180 days or less, Mastercard also requires a reminder three to seven days before the billing date.4Mastercard. Revised Standards for Subscription/Recurring Payments and Negative Option Billing Merchants
Both networks require a simple cancellation mechanism. If the cardholder signed up online, the merchant must offer an online cancellation option. Merchants flagged in Mastercard’s Acquirer Chargeback Monitoring Program who haven’t implemented these standards can face noncompliance assessments on top of existing chargeback penalties.4Mastercard. Revised Standards for Subscription/Recurring Payments and Negative Option Billing Merchants
ROSCA and the FTC Click-to-Cancel Rule
The Restore Online Shoppers’ Confidence Act applies to any goods or services sold online through a negative option feature, meaning the customer will be charged unless they act to cancel. Before collecting billing information, the seller must clearly disclose all material terms, obtain the consumer’s express informed consent before charging the account, and provide a simple way to stop recurring charges.5Office of the Law Revision Counsel. 15 USC 8403 – Negative Option Marketing on the Internet
The FTC finalized its Click-to-Cancel rule in October 2024, tightening the same framework. The rule prohibits misrepresenting material facts when marketing negative option features, requires clear and conspicuous disclosure of material terms before collecting billing information, demands express informed consent before charging, and mandates a simple cancellation mechanism that immediately halts charges. Most provisions took effect 180 days after publication in the Federal Register.6Federal Trade Commission. Federal Trade Commission Announces Final Click-to-Cancel Rule Making It Easier for Consumers to End Recurring Subscriptions and Memberships
The practical consequence for the authorization form: if the customer signs up online, the form and its surrounding checkout flow must present the material terms plainly, capture affirmative consent to those specific terms rather than to general purchase conditions, and be paired with a cancellation path that also works online. A phone-only cancellation for an online signup is out of bounds.
PCI DSS and Handling the Form
Any business that stores, processes, or transmits cardholder data must comply with the Payment Card Industry Data Security Standard.7PCI Security Standards Council. PCI DSS Quick Reference Guide For recurring billing, that means encrypting stored card data, limiting access to authorized personnel, and using secure systems for processing. Authorization forms should be submitted through secure digital portals or encrypted channels. Sending an unencrypted card number by email or standard mail creates obvious interception risks.
The most common mistake merchants make with recurring billing forms is storing data they aren’t allowed to keep. Requirement 3.2 explicitly bans retaining the CVV/CVC after the initial authorization.1PCI Security Standards Council. FAQ: Can Card Verification Codes/Values Be Stored for Card-on-File or Recurring Transactions Recurring charges after that first transaction run against the stored card number and expiration date. Noncompliance can result in fines imposed by the card networks through the merchant’s acquiring bank, loss of the ability to process card payments, and liability for fraudulent transactions tied to a breach.
Providing a Copy and Retaining the Signed Form
After the authorization is processed, the merchant must provide a full copy of the executed agreement to the cardholder.8Consumer Financial Protection Bureau. 12 CFR 1005.10 – Preauthorized Transfers The merchant should keep the signed authorization for the duration of the billing relationship and a reasonable period after it ends. Card network chargeback windows can extend months past the last charge, and the authorization form is the merchant’s primary defense. Without a properly executed form showing clear consent and disclosed terms, a merchant will almost certainly lose any chargeback dispute.
State automatic renewal laws add another layer of record-keeping and notice obligations. Notification periods before automatic renewals vary by state, and merchants operating across multiple states need cancellation and reminder systems that meet the strictest applicable requirement.
Expired and Replaced Cards
Card networks offer account updater services that pass new card numbers and expiration dates to merchants with existing recurring billing relationships. Visa’s Account Updater works by having issuers submit updated card details when accounts change, and enrolled merchants receive those updates through their payment processors.9Visa. Visa Account Updater Overview
For the cardholder, this means a subscription can continue seamlessly after a card is reissued, which is convenient for services they want to keep and frustrating for ones they hoped would quietly lapse. Getting a new card is not a substitute for canceling. If the merchant isn’t enrolled in an updater service, a new authorization form with the updated card details will be needed to keep the recurring charge in place.
Canceling or Disputing a Recurring Charge
The cleanest path is revoking the authorization with the merchant directly. Under ROSCA and the Click-to-Cancel rule, merchants that accepted the original enrollment online must offer an equally simple online cancellation method.5Office of the Law Revision Counsel. 15 USC 8403 – Negative Option Marketing on the Internet Keep written confirmation of the cancellation, such as a screenshot of the confirmation page or the email receipt, because that record becomes evidence if charges continue.
If charges continue after cancellation, they can be disputed as billing errors under the Fair Credit Billing Act. A written dispute must be sent to the card issuer within 60 days of the date the statement containing the charge was sent. The issuer must acknowledge the dispute within 30 days and resolve it within two billing cycles, up to 90 days, and cannot try to collect the disputed amount or report it as delinquent while the investigation is pending.10Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
One boundary worth noting: the rules above cover credit card recurring payments. When a recurring payment is drawn from a bank account or processed as a debit under the Electronic Fund Transfer Act, a separate set of requirements applies, including a 10-day advance notice when the amount changes and a different stop-payment procedure through the consumer’s bank.8Consumer Financial Protection Bureau. 12 CFR 1005.10 – Preauthorized Transfers A merchant that runs both credit card and ACH recurring billing needs the correct rule set for each payment type; a cardholder deciding how to stop a charge needs to know which type they authorized.