Last editedApr 20236 min read
Subscription services have well and truly taken off, with Zuora noting that 80% of customers are demanding new consumption models. Illustrating the point more starkly is a further note that $420bn was spent on subscriptions in the US in 2015, up from $215bn in 2000.
Businesses offering subscriptions, memberships, and payment plans can choose a number of methods to manage regular payments, including recurring card payments, ACH debit, and standing order.
This guide covers everything you need to know about taking regular payments from your customers by credit or debit card, as well as a comparison with other payment methods available to you.
What are recurring card payments?
A recurring credit card payment - also referred to more generally under the terms recurring billing or automatic bill payment - is an authorization provided by the customer that permits the merchant to take repeat payments from them by credit or debit card. These payments will remain in force until the customer cancels the arrangement.
Recurring card payments can be set up via online or paper-based forms. To authorize the your business to take recurring card payments, your customer provides their debit or credit card details (rather than their bank details, which would normally be used to set up an ACH debit).
Recurring card payments are commonly used by businesses such as gyms, internet service or cell providers, and payday loan companies.
A recurring card payment enables your business to take payments from a customer’s card that can be the same or different amounts each time, and with or without a set end date (or a fixed number of payments), without seeking further authorization from them.
Note: Laws may differ from state to state, so if you don't have a trusted payment provider (such as Stripe for card payments, or GoCardless for ACH debit payments) to handle legal compliance for you, it may be worth seeking legal advice before you begin taking recurring card payments from your customers.
When to use a recurring card payment
Recurring card payments are a common way to take recurring payments from customers.
They provide businesses with regular sales opportunities and predictable cash flow. Payments are charged automatically and customers receive their orders without any extra activities.
Recurring card payments are particularly good for:
Transactions which need immediate clearing or next-day payment - E-commerce services such as Amazon Prime often use recurring card payments for subscription fees.
Liquid assets and high value goods - (Such as cars or currency) Other recurring payment methods like ACH debit are not suitable for these transactions, as they present a target for fraudsters.
Recurring card payments are not so good if:
You want to reduce payment failures - If you're a membership or subscription business, recurring card payments typically have higher payment failure rates than other recurring payment options like ACH debit, as card details expire and cards are often lost or stolen (whereas bank accounts cannot be).
You want to reduce cost per transaction - Recurring card payments tend to cost more than other payment methods like ACH debit and standing order.
How to start taking recurring card payments
To start taking recurring card payments from your customers, you'll need to:
Use a payment gateway or payment service provider (PSP) that supports recurring billing
Inform your customer about the recurring billing, and have them choose it as a payment option
Receive, and store a record of, authorization from your customer to take recurring card payments from them (more on this later)
Store the customer's credit or debit card details (Note: The typically 3-digit code on the back of the card, known as a CVV, CVC, or CID, is prohibited from being stored by merchants, in accordance with PCI compliance)
Start processing payments via your payment gateway or PSP
Making changes to a recurring card payment
If the original authorization form your customer signed, for you to begin taking recurring card payments from them, allowed for changes to payment amounts or dates, you may not have to provide any advanced notification.
For example, you may charge your customers based on usage of your services, and their usage varies from month to month. In this case, it's not uncommon for companies to specify a range, rather than a fixed dollar amount, that their customer will be typically charged within.
If the amount you charge falls outside this range - or if you specified a fixed dollar amount, and it differs from that - you should notify your customer at least 10 days before the payment is taken.
Note: This may vary from state to state and it's worth seeking legal advice to be sure.
Which is best for your business: recurring card payments, ACH debit, or standing orders?
Recurring card payments, ACH debit, and standing orders are all automatic payment methods used for collecting regular payments.
Recurring card payments use credit and debit card networks, whereas ACH debit and standing orders are a form of bank-to-bank payment.
Here we lay out the upsides and downsides of recurring card payments for merchants, when compared to ACH debit and standing orders.
| Recurring card payments | ACH debit | Standing order | |
| Set up | You're in control. You control set up, amount, and date of payments. | You're in control. You control set up, amount and date of payments. | Customer is in control. Customer controls set up and you're dependent on them. Unfeasible if you have > 25 customers. |
| Speed of payment | Fast. Varies by provider, but providers like PayPal offer 24-hour turnaround - even for initial payments. Best used if you require next-day payment. | Medium - Fast. ACH debits can take several working days for the funds to reach your account. However, same-day processing capabilities do exist. (Learn more in our guide to ACH payment processing times.) | Fast. Wire transfers are usually delivered quickly - within minutes or hours. When setting up recurring transfers like standing orders, however, some banks advise scheduling them for five days in advance of the due date of the bill, to ensure it will arrive on time. |
| Flexibility | Medium-high. You can charge fixed or varying amounts, and you don’t have to specify a date when you're going to take a payment. (You may have to give up to 10 days advanced notice for changes to amounts or frequency, depending on your customer's authorization.) | Medium-high. Charge fixed or varying amounts and change amount or date of payment without further authorization from your customer. (You need to give advance notice of changes to amount or frequency. GoCardless reduces advance notice to 2 days and takes care of the messages for you.) | Low. You can only take fixed amounts at regular intervals. Any changes have to be authorized by the customer. |
| Cost | High. Square estimates overall card processing fees to be 2.87-4.35% per transaction. Additional costs will also arise from admin involved in chasing customers to update expired card details (at least every three years per customer), or for account updater services. | Low. See our guide to ACH fees, or check out the GoCardless pricing page to see what we can offer you. | Low. Possibility of a small fee taken by your bank, but otherwise free. Likely to be admin overheads associated with managing standing orders. |
| Reliability and customer retention | Medium. Payment failure rates vary, but tend to be greater than 5%, due to cancelled and expired cards, or customers hitting spending limits. Account updater services help mitigate this. See Reliability and customer retention section below. You may be charged for failed payments. | High. Since ACH debit avoids card networks, payment failure rates are typically low, at less than 1%. | Medium. Avoids card networks, so payment failure rates are likely to be less than 1%. But you won’t be notified if a payment fails (e.g. if there are insufficient funds), so you'll have to check accounts manually and chase up customers. |
| Customer protection | Medium. Credit card payments enable customers to apply for a refund, but there are limitations to this. | Medium-high. Customers are protected when making ACH payments, both by the ACH scheme rules as well as Federal Regulation, 'Regulation E'. If unauthorized payments are taken from them, they are able to seek a refund through their bank (within a certain timeframe). Learn more in our guide to ACH customer protection. | Low. No customer protection once payments are made (which gives merchants greater protection). |
Reliability and customer retention
Recurring card payments are more likely to fail than ACH debit payments, leading to revenue loss, as well as unhappy customers. Reasons include cancelled cards (cards are often lost or stolen), expired card details, or customers hitting spending limits.
Payment failure rates vary, but for recurring card payments they tend to be greater than 5%.
There are solutions available to help increase reliability of card payments and reduce associated customer churn. These typically fall into two categories:
Reactive solutions which aim to stop card failures turning into customer churn, by automatically retrying card payments at specific intervals, or by trying another Card on File (CoF) assigned to the customer.
Proactive solutions like account updater services run by card networks like Visa and Mastercard, which aim to prevent card failures happening in the first place. This is done by batch-checking card details with the issuing banks.
Merchants can access account updater services directly from card network providers like Visa, or via an acquirer like Adyen, Braintree, or WorldPay. Acquirers may build their own logic on top of the basic account updater service, for example allowing you to run a report to show which details were updated and what was changed. In addition, billing platforms like Zuora offer this service as an add-on to customers.
Account updater services are not available everywhere, however, since it requires local issuing banks' processors to opt into and integrate with the scheme, which takes time and effort to implement.
It’s worth noting that even in markets where these services are mature, cards may slip through the cracks for a variety of reasons. In the US, for example, while it is now mandatory for issuing banks to participate in these schemes, there are still banks whose haven’t yet integrated.
Cards from banks that are not in the scheme will not be picked up by account updater services. Other cards that may fall through the cracks include international cards, prepaid cards, and cards belonging to unsupported card networks.
Cards may also be missed by account updater services if a bank fails to promptly update Visa and Mastercard about a change in card details (since many smaller banks still rely on manual processes), or if a customer switches card provider.
When it comes to costs, Visa and Mastercard charge for these services. Payment processors like Braintree, Adyen, and WorldPay, and billing platforms like Zuora, may pass these costs on directly to merchants. For example, by offering the service as an add-on or by mixing them into overall service costs.
It’s also worth noting that these technologies require customer card details to be stored in multiple locations, which brings with it associated security risks.
Since ACH debit and standing orders avoids card networks, payment failure rates are typically low, at around 1 or 2%.
If you choose to use automated ACH debit with a provider like GoCardless, you can significantly mitigate the risk of late payments. Since GoCardless optimizes the ACH debit process, our customers enjoy low transaction failure rates.
Customer protections
Recurring card payments enable customers to apply for a refund when using credit cards, but - of course - there are rules and processes in place. The FTC states that consumers can/must:
Dispute any "billing errors" (e.g. unauthorized charges, incorrect dates or amounts, goods and services that weren't delivered as agreed)
Write to the creditor at the address given for "billing inquiries"
Ensure the letter is posted with enough time to reach the creditor within 60 days after the first bill with the error was mailed to you
Have your complaint acknowledged by the creditor, in writing, within 30 days of receiving it (unless resolved)
Have the dispute resolved within two billing cycles after receiving your letter of complaint (but not longer than 90 days)
Withhold payment of the disputed amount (but not other genuine parts of the bill) while it is being investigated
If customers are unhappy with the quality of goods or services delivered, this isn't a "billing error" but they can take the same legal actions against the card issuer, provided:
The purchase was more than $50
The purchase was made in their home state (or within 100 miles of their current billing address)
A good faith effort was made to resolve the dispute with the seller first
ACH debit payments are protected by both ACH scheme rules, and a federal regulation called Regulation E. In short, any unauthorized payments (e.g. never authorized, revoked authorization, payments were different amounts/dates than the authorization specified) can be returned to the customer.
The customer must write to their bank within 60 days of receiving the statement with the unauthorized charge, and it will be refunded without question. There are some intricacies we cover in further detail in our guide to ACH scheme customer protection.
While these ACH debit refunds do present an opportunity for fraudulent activity, with customers asking for refunds they are not entitled to, this risk tends to be highest in certain industries - including gambling, car sales, and other high-value physical goods. For these reasons, it’s not recommended for businesses in these industries to use ACH debit.
For most business however, the risk of these refunds being claimed fraudulently is low. And the protections provided to customers makes ACH debit a highly trusted payment method.
