Card-on-file and recurring payments for regular customers

Card-on-file payments let a business charge a customer's saved card for future purchases without asking for the card each time. Card on file payments work when the card is stored securely by your payment provider, not by you, and the customer has agreed in writing to how and when it will be charged. For regulars who order often, it's a real convenience. It needs clear consent and records to stay safe.

As more customers order ahead or get regular deliveries, this comes up more.

How does card-on-file work?

The customer gives their card once, either in person or through a secure form. Your payment system stores it securely, usually by replacing the card number with a token. A token is a stand-in value that only works with your provider, so the real card number isn't kept on your systems.

Next time the customer orders, you pick their saved card and charge it. No need to ask for the number again.

Recurring payments are a version of the same idea. The card is charged on a schedule, like weekly or monthly, for an agreed amount or service.

Not every payment setup offers stored cards or recurring billing. Ask the NRS Pay team what your setup supports before you promise it to customers.

Why shouldn't you store card numbers yourself?

Because it's risky and it goes against card industry rules.

A notebook with card numbers under the counter, a spreadsheet on the office computer, or a photo of a card on your phone are all targets. If they're lost, stolen, or seen by the wrong person, customers' cards are exposed and your store could be responsible.

The Payment Card Industry Data Security Standard sets strict rules for storing card data. The simplest way to meet them is not to store card data at all. Let a secure provider do it.

And never store the security code. Card rules forbid keeping it after the sale is authorized, even if the rest of the card is stored securely.

How do you get proper consent?

Card network rules expect merchants to get the customer's agreement before storing a card and charging it later. Consent also protects you if a customer disputes a charge.

A simple consent record should include the following.

1. The customer's name and contact information.
2. The last four digits of the card, never the full number.
3. What the card will be used for, such as weekly deliveries or special orders.
4. How the amount will be decided: a fixed amount, or the order total.
5. When charges will happen.
6. How the customer can cancel or update the card.
7. The customer's signature or written agreement, and the date.

Send a receipt every time you charge the card. That keeps the customer informed and makes disputes less likely.

Visa's small business regulations page gives background on card network rules for merchants.

When does card-on-file fit a neighborhood store?

It fits a few situations well.

Regular delivery customers, like an elderly neighbor who gets groceries every week.

Local businesses that buy supplies from you on a schedule.

Recurring orders, like a standing weekly catering tray for an office.

Deposits and balances on special orders, where the customer agrees to have the balance charged on pickup.

Here's a hypothetical. A nearby office orders coffee and snacks every Monday. With their card on file and a signed agreement, you charge the order total each Monday and give the customer a receipt. They don't have to call in a card, and you have a clean record for each charge.

It fits poorly for walk-in customers. At the counter, a chip or tap sale is simpler and cheaper. See NRS Pay equipment for readers that work with the NRS POS.