Your virtual card number changed. The subscription followed

The pitch you hear most about virtual cards is that the number is disposable. Leak it and it's dead, problem solved. That part is true. Somewhere along the way, though, "disposable" quietly became "I can stop a subscription by changing the card number." That second belief is where people lose money. There is a documented service at the network level whose entire job is to move subscriptions onto your new card number, and it has been running for years.

Start with the uncomfortable fact

Visa calls it the Visa Account Updater, VAU. Mastercard's version is the Automatic Billing Updater, ABU. Different names, same function: when a card is reissued, expires, or gets closed, the issuer submits the change to the network, and participating merchants receive the replacement details. The original intent is hard to argue with. You get a new physical card in the mail, and Netflix keeps working. What the mechanism cannot tell apart is a cardholder who wants to keep paying and a cardholder who was counting on the old number dying.

Here's a real-world data point. A Reddit user subscribed to Amazon Prime with a virtual card number from Apple Cash, requested a fresh number before the next billing date, and watched the autopay charge land anyway. The support thread explains why: merchants pay the networks for automatic credential updates, and the only reliable way to stop a subscription is to cancel it with the merchant. This is not an edge case affecting three people. Grand View Research puts the global consumer virtual card segment at roughly 5.97 billion dollars in 2024, growing at 21.8 percent a year toward 19.4 billion by 2030. The bigger the user base, the more often the "I'll just change the number" assumption gets tested, and the more often it fails.

American Banker reported an uglier version of the same mechanism in 2026. Chase customers who had cards replaced after fraud saw new fraudulent charges land on the replacement card within days, because merchant-side updates carried the billing relationships, some of them unwanted, straight onto the new number. Your average case won't look like that. The plumbing is identical, though.

How VAU and ABU actually work

The chain has four links, and none of them involve you.

• Issuer reports the change. When a card number, expiration date, or account status changes, the issuing institution submits it to the network. For a virtual card platform, that issuer is the sponsor bank behind the platform's BIN.
• Merchants ask, or subscribe. Credential-on-file merchants query their stored cards in batches through their acquirers, or subscribe to automatic pushes, so replacement numbers arrive without anyone asking.
• Deadlines force adoption. Visa's rules require merchants to write received updates into their databases within five business days, and token-vault operators get two business days. This is not a courtesy service the merchant can ignore.
• The next charge uses the new number. On billing day the merchant charges the fresh credential. From your side it looks like the subscription chased you.

Two details worth keeping. First, the service isn't free for merchants; they pay per inquiry, which is exactly why its heaviest users are subscription businesses, SaaS, streaming, cloud platforms, the same merchants virtual card users bind to most. Second, opt-outs exist on the issuing side. Cardholders can be opted out entirely, and Visa has a dedicated Issuer Stop Advice API so a bank can block specific merchants from receiving updates. The opt-out status also survives card replacement: once it's set, it follows the account until the issuer removes it. Almost no virtual card platform exposes that switch to users. Ask a support agent whether your canceled card can still be charged and you'll usually get an answer about card status, not about the credential record sitting in a merchant's billing system.

One misunderstanding to clear up: VAU and ABU move card data, they don't create billing authority. A merchant can only keep charging you because you once agreed to recurring payments. The practical exposure isn't "a stranger can suddenly charge my new card." It's "the subscription I thought I starved out is still alive, and it found the new number." If charges already went through, the recovery path is the dispute process, which we cover in our guide to chargeback rights.

Four signals your card will follow you

Platforms rarely document whether their card products participate in updater services. You can get close from the outside.

Product shape is the first signal. American-style privacy cards with merchant locking and per-card spend limits were designed with these semantics in mind, and their behavior is documented. Balance-based virtual cards, the common type in this market, are usually just card numbers on a prepaid program, and their behavior depends on how the upstream BIN sponsor configured things. The card you see in the app and the card inside the network may not be the same product at all.

Pause versus delete is the second. Be careful with platforms that only let you delete a card. Deletion sometimes triggers reissue rather than closure, and if the issuer participates in updates, the replacement can propagate to merchants. A platform with per-card limits and a pause button leaves one more layer of control in your hands.

The cheap experiment is the third. Subscribe to something inexpensive with a small card, change or delete the number, and watch the next cycle. A stack of failed-payment emails and retries means the merchant never got a replacement. Silence and a successful charge means the update path exists. The experiment costs a couple of dollars, which beats learning the same lesson on a 200-dollar annual plan.

Transparency is the fourth. A platform whose terms explain how it handles merchant-initiated update requests earns credit. A platform that dodges the question should be managed as if updates are on by default.

Change the approach: kill the limit, not the number

If the number can migrate, stop betting on the number. A migrated card number still hits whatever limit was set on the card. The subscription can knock all it wants; there is nothing behind the door.

The layering I use in practice:

• Free trials and unknown services get a dedicated card with a limit covering exactly one billing cycle. Forget to cancel and the merchant's next charge draws zero. This is the cleanest answer to trial-to-subscription conversion traps.
• Real subscriptions deserve a real cancellation in the merchant's account, with screenshots and a confirmation email. A dead card number was never a contract termination; our cancellation guide covers the workflow.
• Ad accounts are the worst place to experiment, because authorization holds and reserves make "money in the account" and "charge succeeds" different questions. Read the authorization holds guide before touching a payment method mid-campaign.

Two habits worth adopting alongside. Prefer platforms with per-card limits and pause functions; products that separate card balances from the main wallet, such as RDVCC, add a buffer by design. And before signing up for anything, spend ten seconds confirming the service has its own cancel button. A working cancel button in the merchant's account beats every card feature combined. For comparing card products side by side, the card directory has the full dataset.

One more low-cost habit: every quarter, walk through the list of merchants you've ever bound a card to and cancel what you no longer use, instead of waiting for failed-payment emails to remind you. The list is easy to rebuild from recurring charges on your statements. Jot each card's purpose into its note field while you're at it. Six months from now, you'll thank yourself.

Quick answers

My card number changed and the subscription still charged. Can I get the money back?

Cancel at the merchant first and keep evidence, then dispute the charges that already landed. Misapplied recurring charges are disputable under card network rules in most cases; the dispute guide above covers the evidence. "I forgot to cancel" is not a reason, so don't write your claim that way.

Do single-use cards get updated?

No. The credential closes after the transaction, so there is nothing to update. The catch is that products marketed as one-time are sometimes just merchant-locked or deletable. Read the product type before relying on it. The real exposure concentrates in reusable balance cards.

Support told me a closed card can't be charged. Is that wrong?

No, but it answers a different question. They described the card's status. Updater services replace the credential on the merchant's side. The question to ask is direct: does this platform's card product participate in Visa VAU or Mastercard ABU, and can merchants receive replacement numbers? A platform that can answer that question straight has a compliance team worth something.

Editor's note: this is a mechanism analysis, not a platform recommendation. Updater participation varies by issuer, BIN sponsor, and merchant configuration; the Visa developer documentation and Mastercard's ABU documentation are the authoritative sources. Market figures cited are from Grand View Research, 2024 baseline.