Visa Account Updater is a behind-the-scenes service that shares your new card number and expiration date with merchants who store your payment details for recurring billing.1Visa Account Updater (VAU) automatically shares updated card numbers and expiration dates with merchants who store your payment credentials for recurring billing. When your bank issues a replacement card, the updated details flow through a central Visa database to businesses you subscribe to, so charges keep going through without you logging in and retyping the card. Issuing banks are required to submit changes within two business days of a new card becoming active, and Visa encourages daily submissions.2Issuers are required to submit changes to the VAU database within two business days of a new card becoming active in their authorization system, though Visa encourages daily submissions for faster coverage.
What Triggers an Update
Several routine events in a card’s life cause your bank to push new information into the database. The most common is natural expiration: a replacement card arrives with a new date, and that date gets shared.3The most routine is natural expiration: your bank sends a replacement card with a new date, and VAU picks up that change. Reporting a card lost or stolen also triggers an update, because your bank issues an entirely new number and flags the replacement for merchants holding the old credentials.4If you report a card lost or stolen, your bank issues an entirely new card number, and VAU flags that replacement for merchants holding your old credentials.
Product changes work the same way. Upgrading from a standard card to a rewards or premium tier sends the new number and date into the system, as do portfolio conversions, including migrations from Mastercard, American Express, or Discover onto Visa.5When your bank upgrades you from a standard card to a rewards or premium tier, the new card number and expiration date flow into the system. Portfolio conversions work the same way, including migrations from Mastercard, American Express, or Discover over to Visa. Account closures are tracked too, signaling merchants that a payment method is no longer valid, whether you closed it or your bank did.6VAU tracks account closures, signaling to merchants that a specific payment method is no longer valid, whether the closure was your choice or your bank’s decision.
How Merchants Receive the New Details
The system runs through a central Visa database that sits between two sides. Your issuing bank submits electronic files whenever your account details change. Merchants, working through their acquiring bank or payment processor, submit the card numbers and expiration dates they already have on file. Visa matches the two and returns any updates.7On one side, issuing banks submit electronic files whenever a cardholder’s account details change. On the other side, merchants (through their acquiring bank or payment processor) submit inquiries containing the card numbers and expiration dates they have on file. Visa matches the merchant’s stored data against the issuer’s updates and returns any new credentials that are available. The merchant and your bank never talk directly.8The merchant and the issuing bank never communicate directly.
Merchants pick up the new details in one of two ways. In batch processing, the merchant sends a file of stored card details to their processor on a schedule, gets a response file back with updates, and refreshes their billing database in one pass.9A merchant sends a file containing all stored card details to their processor at a scheduled interval. The processor submits the file to VAU, retrieves any matches, and returns a response file with updated account numbers and expiration dates. The merchant then refreshes their billing database in one pass. With Real-Time VAU, VisaNet checks each authorization request against the database as it comes in and, if the number or date has changed, updates the request on the fly before forwarding it to the issuer.10When a merchant submits an authorization request, VisaNet checks the transaction against the VAU database before it reaches the issuer. If the card number or expiration date has changed, the authorization request is updated on the fly and forwarded to the issuer with the correct credentials. Either way, the practical result for you is the same: a subscription that would have failed with an expired-card decline goes through instead.
What the Service Does Not Cover
The service has clear boundaries. Real-Time VAU is limited to card-not-present transactions, so face-to-face payments at a physical terminal are excluded.11Real-Time VAU is limited to card-not-present transactions. Face-to-face payments at a physical terminal are excluded. Transactions in certain outbound telemarketing merchant category codes (5962, 5966, and 5967) are blocked from Real-Time VAU, as are transactions that include a CVV2 value and zero-dollar account verifications.12Transactions involving certain merchant category codes associated with outbound telemarketing (5962, 5966, and 5967) are also blocked from Real-Time VAU. If a transaction includes a CVV2 value, or if it is a zero-dollar account verification, Real-Time VAU will not process it. Brand conversions away from Visa are not supported by Real-Time VAU either.13Brand conversions away from Visa, where an account moves to a different card network, are not supported by Real-Time VAU either.
Coverage also depends on your bank. Visa has required U.S. issuers to participate for consumer credit and debit portfolios since 2016, but international issuer coverage varies. If your bank has not submitted an update to the database, there is nothing for a merchant to receive.14While Visa has required U.S. issuers to participate in VAU for consumer credit and debit portfolios since 2016, international issuer coverage varies. If a cardholder’s bank has not submitted updates to the database, there is nothing for VAU to return regardless of how the merchant queries it. And the service only covers Visa-branded cards; Mastercard and American Express run their own separate systems.15VAU only covers Visa-branded cards.
The active database holds two years of updates. If a merchant has not queried a particular account in more than two years, the update may have aged out.16The active database only holds two years of updates. If a merchant has not queried for a particular account in over two years, the update may have been purged from the active database and will not appear in results. For an annual subscription that lapsed and never re-billed, the automatic hand-off may not be there anymore.
How to Opt Out as a Cardholder
You can opt out, but the request has to go through your issuing bank. There is no way to opt out directly through Visa or through individual merchants.17The process goes through your issuing bank: contact them and request removal from the VAU service. There is no way to opt out directly through Visa or through individual merchants.
When your bank processes the request, it submits a Cardholder Opt-Out code that blocks your updated credentials from being shared with any merchant. The status stays with your account chain, so even if your bank later issues you a new card, the new details will keep being withheld until the opt-out is lifted.18A Cardholder Opt-Out code blocks your updated credentials from being shared with any merchant. The opt-out status stays with your account chain, meaning that even if your bank later submits new card details, VAU will continue withholding them from merchants until the opt-out is removed. If your bank uses the Visa Online application to submit the opt-out, they can set an end date up to two years out or leave it open-ended.19If your bank uses the Visa Online application to process the request, they can set an end date up to two years out, or leave it open-ended for an indefinite opt-out.
Opting out means every recurring charge tied to your card will fail once the card on file expires or is replaced. You will have to log in to each merchant and update the card yourself. That is a workable trade for some people and a headache for others.
Blocking a Single Merchant Instead
If your concern is one specific business rather than the service as a whole, your bank can submit a Stop Advice that prevents that merchant from receiving your updated credentials while other merchants keep getting them normally.20If you report fraud involving a specific merchant, your issuer can submit a Stop Advice that prevents that particular merchant from receiving your updated credentials while still allowing other merchants to get updates normally. This is more surgical than a full opt-out and lets you keep your legitimate subscriptions running while cutting off a problematic business. This is the tool to ask about if you are trying to shut off a single subscription that keeps finding a way to charge you after a lost or stolen card report.
Disclosure and Regulation E
Federal Regulation E, which governs electronic fund transfers, does not specifically address automatic card credential updates and does not require banks to notify you before sharing updated card information through the service.21Federal Regulation E, which governs electronic fund transfers, does not specifically address automatic card credential updates or require banks to notify you before sharing updated card information through VAU. Whether your cardholder agreement discloses participation is up to the bank. Visa advises issuers to consult their own legal departments about disclosure language; there is no uniform federal mandate.22Visa advises issuers to consult their legal departments about appropriate disclosure language, but there is no uniform federal mandate requiring it. If you want to know whether your bank is enrolling you, ask, or read the fine print in the agreement.
Notes for Merchants Enrolling in VAU
Enrollment runs through your payment processor or acquiring bank, not through Visa directly.23Enrollment starts with your payment processor or acquiring bank. Merchants do not interact with Visa directly. You need a valid Merchant Identification Number, an account in good standing with your acquirer, and the card numbers and expiration dates you currently have on file for customers, since that stored data is the baseline the system matches against.24To participate, you need a valid Merchant Identification Number and a merchant account in good standing with your acquirer. You also need to provide the processor with the card numbers and expiration dates you currently have stored for your customers, since that data serves as the baseline the system uses to identify which accounts have been updated.
PCI DSS compliance is a prerequisite, and the card networks fine acquiring banks for merchants that fall out of compliance, with those fines passed through.25Maintaining compliance with the Payment Card Industry Data Security Standard (PCI DSS) is a prerequisite, since the entire system depends on merchants storing card data securely. The card networks impose fines on acquiring banks for merchants that fall out of compliance, and those fines are passed through to the merchant. The baseline data you submit has to be accurate; incorrect or stale numbers will not match and will return nothing.26Submitting incorrect or outdated baseline credentials means the system cannot match your records against the issuer’s updates, and you will get no results back.
If you accept multiple card brands, you will need separate integrations. Mastercard runs Automatic Billing Updater, which offers a push model with automatic notifications and a pull model where merchants query before submitting a card-not-present transaction.27Mastercard Automatic Billing Updater (ABU) offers two models: a push model where merchants automatically receive update notifications for accounts they have subscribed to, and a pull model where merchants query the system before submitting a card-not-present transaction. American Express operates Cardrefresher through a registry file system, requires a signed Cardrefresher Supplement, and, unlike Visa’s service, requires explicit customer authorization to keep the card on file before enrolling it.28American Express Cardrefresher works through a registry file system. Merchants submit a file of stored American Express card details, and Cardrefresher monitors that list and sends daily electronic files with any updated card numbers and expiration dates via secure file transfer. Merchants must sign a Cardrefresher Supplement to their existing American Express acceptance agreement and go through a separate configuration and certification process. Unlike VAU, Cardrefresher requires merchants to obtain explicit customer authorization to retain card information on file before registering cards in the service. Most large processors bundle access to all three, but each network has its own data formats and enrollment rules.29Most large payment processors bundle access to all three services, but the merchant still needs to support the data formats and enrollment requirements for each one.