Mastercard Automatic Billing Updater: Why Replacing Your Credit Card May Not Stop Unauthorized Recurring Debits in Pakistan

Mastercard Automatic Billing Updater can allow recurring payment credentials to continue after a credit card is replaced, raising important questions for Pakistani cardholders dealing with disputed or unauthorized charges.

 I stared at the banking notification longer than I should have. The card linked to the earlier disputed transaction no longer existed. I had reported the problem, cancelled the card, and received a replacement with a different 16-digit number and expiry date.

Yet another charge appeared.

For most Pakistani cardholders, the logic seems simple. If someone keeps charging an old credit card, cancel the card and the payment route dies with it. A replacement card should create a clean break.

Modern card networks do not always work that way.

A system designed to prevent Netflix subscriptions, utility payments and other legitimate recurring transactions from failing can sometimes preserve a merchant's payment relationship even after the bank replaces the physical card. Mastercard calls one part of this infrastructure Automatic Billing Updater, or ABU.

That does not mean every transaction appearing on a replacement card came through ABU. Network tokens and other credential-on-file arrangements can also survive changes to a physical card. For a Pakistani consumer trying to stop an unwanted recurring charge, that distinction matters.

Why a New Card Number May Not Create a Clean Break

Mastercard describes Automatic Billing Updater as a service for credential-on-file and recurring payments. Participating issuers provide account changes, while participating acquirers and merchants can obtain updated credentials so payments do not fail simply because a card expired or the issuer replaced it. Mastercard specifically says ABU can support cards reissued because of fraud as well as lost or stolen cards.

Consider an ordinary subscription.

I give a streaming company my Mastercard details. The merchant stores the card as a credential on file. Months later, my bank replaces that card. Without an updater service, the next subscription payment could fail because the merchant still holds the old PAN and expiry date.

ABU exists to prevent that disruption.

Mastercard's current ABU privacy notice says the service can process the old account number and expiry date and the new account number and expiry date. It does not say that ABU supplies the new CVV to the merchant.

That distinction is useful because many people assume a merchant must somehow know the CVV printed on the replacement card. Recurring and credential-on-file payments do not necessarily operate like a customer typing a card number, expiry date and CVV into a checkout page for a new purchase.

Visa operates a comparable system called Visa Account Updater, or VAU. Visa describes participating issuers submitting updated account information and participating merchants or acquirers requesting the latest credentials before processing stored-card payments.

So the basic phenomenon is not unusual or mysterious. It is part of global card infrastructure.

The problem begins when the cardholder wants a payment relationship to end.

ABU Is Not the Only Possible Explanation

I would be careful about blaming every recurring charge on Mastercard ABU.

Modern payment systems also use network tokens. A merchant, digital wallet or payment processor may transact through a token that represents the underlying card rather than repeatedly transmitting the physical card number.

A token can have its own lifecycle. The payment infrastructure may update the credential behind it when the issuer replaces the underlying card.

Account-updater services and tokenization can also interact. Mastercard's own gateway documentation describes account-updater functionality updating payment details stored against tokens in supported configurations.

This creates an important investigative question.

If I replace a compromised card and a disputed merchant charges me again, I should not merely ask:

"How did the merchant get my new card number?"

I should ask something more precise:

"What credential and payment mechanism allowed this transaction to reach my replacement account?"

The answer could involve ABU. It could involve a stored network token. It might involve another credential-on-file mechanism.

In a genuine fraud case, there could also be an entirely separate compromise.

The transaction data available to the issuing bank should help establish what actually happened.

What Pakistani Banks Are Required to Give Cardholders

Pakistan already has an important card-control rule.

Under State Bank of Pakistan PSD Circular No. 09 of 2018, card-issuing banks and microfinance banks were required to develop the capability that allows customers to activate or block cards for online and cross-border transactions when required. The circular also requires real-time fraud-monitoring tools and procedures for escalating suspicious card activity.

That gives a Pakistani cardholder meaningful regulatory support.

But I would not stretch the circular beyond its wording.

It does not specifically regulate Mastercard ABU. It does not say that every Pakistani bank must provide a Mastercard ABU opt-out button in its mobile application. Nor does the circular establish that sending replacement credentials through an account-updater service automatically violates SBP rules.

A more interesting problem sits underneath.

SBP gives the consumer control over online and cross-border card usage. At the same time, international card infrastructure can preserve established credential-on-file relationships after the physical card changes.

How those systems interact is not obvious to the customer.

I think banks should be able to explain that interaction when a customer disputes a recurring transaction. Simply saying, "Your card was replaced, so the merchant cannot have the new details," may no longer describe how the payment system actually works.

Unauthorized Fraud Is Not the Same as a Subscription Dispute

There is another distinction that Pakistani cardholders should understand.

Suppose I subscribed to a service, accepted its recurring billing terms and later forgot to cancel it properly. The resulting transaction may be disputed, but it is not necessarily the same thing as card fraud.

Now imagine I have never dealt with the merchant. I never gave it my card details and never authorized a subscription.

That is a different case.

The distinction becomes particularly important under SBP BPRD Circular No. 04 of 2023, which introduced security controls and liability requirements for digital banking fraud. SBP states that regulated institutions that fail to implement the prescribed controls can become liable to compensate affected customers.

SBP's associated FAQs also require regulated institutions to investigate card-related and e-commerce fraud, including 3-D Secure and non-3-D Secure transactions.

I would therefore avoid telling a bank only that a transaction is "unauthorized."

Give it the facts.

Was there ever a relationship with the merchant? Was the original transaction authorized? Was a subscription cancelled? Did the customer report the earlier transaction as fraudulent? Did the same merchant appear after replacement of the card?

Those details determine the character of the dispute.

They may also become important if the case eventually reaches the Banking Mohtasib.

Visa Shows That More Consumer Control Is Technically Possible

An interesting comparison appears in Visa's public documentation.

Visa expressly documents a cardholder opt-out mechanism for Visa Account Updater. According to Visa, an issuer can submit an opt-out for a particular cardholder, and that status can remain attached to the account chain even after subsequent account updates.

Visa also describes technology that can allow issuers to identify merchants requesting updated card information. One Visa use case even describes a customer who opts out and then chooses which merchants should receive replacement payment details manually.

That is significant.

It demonstrates that automatic credential updating does not have to mean zero consumer control.

I would not claim that Mastercard provides Pakistani consumers with an identical facility unless the issuing bank or Mastercard confirms it. I have not found sufficient public Mastercard documentation to support that assertion.

That is why I would put a different question to a Mastercard issuer:

What controls are available to prevent the disputed merchant from receiving or successfully using updated payment credentials?

That wording forces the investigation toward the payment infrastructure rather than a scripted conversation about replacing plastic.

What I Would Do After a Recurring Charge Survives Card Replacement

A telephone complaint is useful, but I would not stop there. I would create a written record and make the questions technically specific.

1. Dispute the transaction formally. State clearly whether I have ever dealt with the merchant and whether I authorized any recurring-payment arrangement.
2. Ask the bank how the transaction reached the new account. I would specifically ask whether Mastercard ABU, a network token, another credential-on-file service, or a newly supplied card credential enabled the transaction.
3. Withdraw authority for future merchant-initiated charges. I would identify the merchant by the descriptor appearing on my statement and ask the bank what mechanism it can use to prevent further transactions from that merchant.
4. Ask about updater and token controls. Instead of assuming a Mastercard ABU opt-out exists, I would ask whether the issuer can suppress account updates, revoke associated network tokens, terminate stored-credential continuity, or apply another network-level restriction.
5. Use the bank's e-commerce and international controls. SBP requires card issuers to provide online and cross-border activation or blocking capability. I would use those controls while the dispute remains unresolved. Whether such a switch blocks every type of merchant-initiated transaction can depend on the issuer's implementation, so I would ask for written confirmation rather than assume it does.
6. Keep the complaint number and written correspondence. If the charge returns, the earlier complaint establishes that the bank already knew about the disputed payment relationship.

There is one request I would make particularly clear:

Please confirm in writing what action has been taken to prevent this merchant from initiating further transactions against my card account, including transactions submitted through stored credentials, recurring-payment credentials, account-updater services or payment tokens.

That is much harder to answer with "change your card."

The Banking Mohtasib Deadline Is Now 30 Days

Pakistani consumers should also note an important legal change.

Older guidance may still refer to a 45-day waiting period before approaching the Banking Mohtasib Pakistan. The current text of Section 82D of the Banking Companies Ordinance, 1962, as amended in 2024, uses 30 days.

The complainant must first ask the bank to resolve the grievance. If the bank fails to respond within 30 days, or gives a response that the complainant finds unsatisfactory within that period, the complainant may approach the Banking Mohtasib within a further 30 days. The law also allows the Mohtasib to condone a delay where sufficient grounds exist.

The Mohtasib's jurisdiction expressly includes complaints involving fraudulent or unauthorized withdrawals or debit entries in accounts.

That makes written documentation important.

I would preserve the disputed transaction, replacement-card date, earlier complaint reference and the bank's written explanation of how it tried to stop future charges. Those records can turn a vague complaint into a traceable sequence of events.

A Replacement Card Is No Longer the Same as a Financial Reset

The physical card still shapes how most people imagine card security. Sixteen digits sit on the front or back. A CVV appears nearby. The bank cancels those numbers and prints new ones.

It feels final.

Payment infrastructure has moved beyond that physical model. Mastercard ABU exists specifically so credential-on-file relationships can continue after account details change. Visa operates similar infrastructure, while tokenized payments add another layer that the ordinary cardholder rarely sees.

None of this means an unauthorized merchant has a permanent right to charge a replacement card. Nor does it mean every charge that survives replacement proves that the bank transmitted the new PAN through Mastercard ABU.

It means something less comfortable.

Replacing a card and terminating a payment relationship are no longer necessarily the same technical event.

For a Pakistani customer, that changes the conversation with the bank. I would no longer ask only for another card number. I would want to know which stored credential survived, which network mechanism kept it alive, and what the issuer has actually done to stop that merchant from using it again.

The piece of plastic may have changed.

The payment relationship may not have.