If your bank cancels your card because of fraud, the natural assumption is that the problem is over.
New card, fresh start, criminal locked out. Unfortunately, research suggests that’s not always how it works. A background feature designed to make life easier when cards get renewed can quietly let fraudsters carry on spending using your replacement card, and most major banks don’t give customers a straightforward way to switch it off.
The feature in question runs automatically behind the scenes whenever you save a card to an app, a streaming subscription, or a digital wallet. Most people have never heard of it, and that lack of awareness turns out to be a real problem when fraud is involved.
Your card details update themselves without you doing anything.
Most of us have card details saved somewhere, in apps like Uber, subscription services like Netflix, or digital wallets like Apple Pay and Google Wallet. When your card expires or gets replaced, a piece of background technology automatically updates those saved details for you, so you don’t have to manually re-enter your card number everywhere it’s stored.
This technology is run by the big card networks—Visa and Mastercard in particular—each under a slightly different name. It’s switched on by default for most banks, and most major online retailers are signed up to receive these automatic updates too. In normal circumstances, it’s a genuinely convenient feature that saves people the hassle of updating dozens of saved payment methods every time a card changes.
This becomes a problem when fraud is involved.
The issue arises when a scammer has already saved a victim’s card details to an online account or digital wallet of their own. If the connection between the old card and that fraudulent account isn’t really broken when the card is cancelled, the system can automatically update the scammer’s saved details with the new card number, allowing the fraud to simply continue uninterrupted.
This appears to be a genuinely common problem. In a recent survey, 61 percent of people who had experienced card fraud in the past two years said they went on to experience further fraud on their replacement card within three months of receiving it. Not every one of these cases will be linked to this specific automatic update feature, but the scale of the figure suggests something is going wrong fairly regularly.
Banks are supposed to break the link, but mistakes happen.
In theory, banks block these automatic updates whenever fraud has been confirmed on an account. In practice, the link doesn’t always get broken entirely. One person working in banking fraud prevention said fraud teams can be under pressure to meet targets, such as closing a set number of cases within a certain time, which creates room for mistakes during a process that needs to be handled carefully.
There are also cases where banks correctly block both the fraudulent payments and the automatic updates, only for the merchant or a middleman payment processor to find a way around the block and reprocess the payment anyway. It’s a reminder that even when a bank does everything right on its end, the wider payment chain involves several other parties who may not follow the same process.
Can you actually opt out of these automatic updates?
Visa and Mastercard have both said that customers can ask their bank to opt them out of automatic updates entirely, meaning that when a card is replaced, none of your saved accounts or wallets would update automatically, and you’d need to re-enter the new details yourself everywhere. That sounds straightforward in theory.
In practice, testing this with major UK banks revealed a different picture. Researchers contacted several big names including Barclays, HSBC, Lloyds, Nationwide, NatWest and Santander, and in most cases, the customer service staff had no clear idea what was being asked for, even when the correct technical terms were used. Only Starling and Monzo showed any clear understanding of the feature during these calls, and even then, the process for actually opting out wasn’t always simple or available to everyone.
What different banks actually offer right now
The picture across banks is inconsistent. Monzo offers customers the ability to opt out, but only at the point of ordering a new card, by ticking a box during that process. Starling said it couldn’t offer a customer-controlled opt-out, but does automatically opt replacement cards out of these updates whenever a card is cancelled due to fraud, or indeed cancelled for any reason at all.
American Express said customers can opt out by calling the number on the back of their card, though frontline staff didn’t always seem aware this was possible when contacted directly. Barclays, Lloyds and Nationwide don’t currently offer a customer opt-out at all, relying instead on blocking specific merchants involved in fraud rather than switching the feature off entirely. NatWest doesn’t offer a general opt-out either, but does apply one automatically once fraud has been confirmed on an account.
Blocking specific merchants isn’t a perfect solution, either.
Rather than switching the feature off completely, some banks rely on blocking updates to the specific merchant where fraud took place, sometimes called a merchant block. Amex, Lloyds, Santander and Nationwide all use this approach in cases of confirmed fraud, and it can be an effective way of cutting off the fraudster’s access without disrupting every other saved payment method on the account.
The drawback is that merchant blocks can create unintended problems of their own. If both the fraudster and the genuine cardholder happen to use the same merchant, blocking that merchant to stop the fraud can also accidentally stop the legitimate customer from using their own card there too, which creates a frustrating knock-on inconvenience for someone who’s already been a victim.
What the card networks and banks say about all this
Mastercard says its update service reduces the inconvenience of missed or delayed payments by keeping card details current with retailers, and that updates stop once a bank marks a card as closed, with an opt-out available through the customer’s bank. Visa makes a similar case, saying its version of the service helps avoid declined payments, late fees and missed payments on things like insurance, while noting that responsibility for stopping updates in cases of fraud sits with each individual bank.
Several banks pointed to their own safeguards when asked directly. Starling said its process doesn’t apply to cards cancelled due to fraud or by customer choice, framing this as an added layer of protection. Lloyds said it applies payment blocks that carry over to new cards when fraud is suspected. Nationwide said it doesn’t currently offer a full opt-out but is keeping the option under review, and that it acts quickly to refund and investigate if a fraudulent recurring payment is spotted on an account.
What can you actually do to protect yourself?
If you’ve been a victim of card fraud, it’s worth asking your bank directly whether the link between your old card and any fraudster-controlled accounts has actually been broken, rather than assuming it has been handled automatically. Keeping a close eye on your account in the weeks after receiving a replacement card is a sensible precaution, since repeat fraud tends to show up fairly quickly if it’s going to happen at all.
Report any payments you don’t recognise to your bank straight away, since banks are required to refund unauthorised payments in almost all cases. If you want to specifically ask about opting out of automatic updates, it helps to know which network your card uses and use the right terminology. Amex calls its version Cardrefresher, Mastercard calls it the Automatic Billing Updater, and Visa calls it the Visa Account Updater. Be prepared for some confusion on the other end of the phone regardless, and if you feel you’ve been let down, you can escalate a complaint to the Financial Ombudsman Service, which is free and has the power to put things right.
