My Bank Replaced My Credit Card. Then Another Unauthorized Transaction Appeared

 

A replaced Bank Alfalah credit card can still face unauthorized charges if an old recurring-payment or stored-credential relationship remains active.

Bank Alfalah replaced my compromised card. I thought the old payment trail had ended. An unauthorized USD 8 transaction made me look much more closely at what “card replacement” actually means.

The New Card Was Supposed to End the Problem

I looked at the transaction and felt more irritation than panic. It was only about USD 8.

That was precisely the problem.

The amount was small enough to dismiss. Yet I had already gone through the trouble of replacing my Bank Alfalah credit card after problems with an online merchant. The old card should have belonged to the past.

Instead, another unauthorized transaction appeared.

For an ordinary cardholder, the first thought is obvious: How did a merchant get access to my new card when I never gave it the new number?

I work around banking and payment systems, so that question bothered me for another reason. A plastic card is only the visible part of a much larger payment relationship. Behind it sit merchant-stored credentials, recurring-payment instructions and card-network services designed to keep legitimate subscriptions running even when a card expires or gets replaced.

That convenience can become confusing when the merchant relationship itself is the problem.

My dispute with Bank Alfalah grew from that distinction.

I was not merely asking the bank to replace a piece of plastic.

I wanted the old payment relationship broken.

I Had Already Told Bank Alfalah What I Wanted

On 21 June 2026, I wrote to Bank Alfalah after a merchant problem that I believed could survive an ordinary card replacement.

My instruction was unusually specific.

I asked the bank to close the underlying credit-card profile associated with the compromised card and issue a clean replacement relationship that would not inherit old recurring-payment credentials or merchant updater associations.

I called it a hard product closure.

That may not be Bank Alfalah's own internal terminology. The terminology matters less than the instruction itself. I explained in plain English what outcome I wanted: do not simply change the card number and allow the old merchant relationship to follow it.

I had a reason to worry.

Mastercard operates a service called Automatic Billing Updater, or ABU. Mastercard says the system can provide participating merchants with updated payment credentials when a stored card expires, is renewed or changes. Mastercard's own material explains that participating issuers can submit account changes and recurring or card-on-file merchants can receive updated information through their acquirers.

The system serves a legitimate purpose.

Imagine that your Netflix-style subscription uses an old card. The bank replaces the card because it expired. Without an updater service, the next monthly payment might fail and interrupt your service.

ABU helps prevent that.

Mastercard also states that the service covers account changes associated with reissued cards, including cards replaced because of fraud or loss.

Now reverse the situation.

What happens when the customer does not want a particular stored merchant relationship to continue?

That was the question behind my June email.

Bank Alfalah Answered a Different Question

By August, I believed the underlying problem had not been solved.

On 30 August, I wrote again. I reminded Bank Alfalah of my June instruction and said historical payment information appeared to have migrated into the replacement-card environment.

I wanted the bank to investigate the account-level relationship.

The response surprised me.

Bank Alfalah's Complaint Management Unit told me that my replacement card had been delivered to my registered address on 24 June.

I already knew that.

Card delivery was not my complaint.

I replied and explained the distinction again. I said I was complaining about the failure to break the previous recurring-payment relationship and about an unauthorized transaction that had appeared on the replacement card.

I also copied the State Bank of Pakistan's Consumer Protection Department.

Bank Alfalah responded again.

This time I was asked to provide a screenshot of the “error” I was facing.

There was no error screen.

No application had crashed. No password had failed. I was not complaining that the card would not activate.

I was reporting an unauthorized card transaction after replacement and asking what had happened to the old merchant-payment relationship.

The exchange exposed a problem that matters beyond my own USD 8.

A customer can describe the technical issue correctly and still enter the wrong customer-service workflow.

Replacing a Card Does Not Always Mean Starting From Zero

Most cardholders think in physical terms.

Old card cancelled.

New card issued.

Problem finished.

Digital payments do not always work that way.

Mastercard describes ABU as a mechanism through which updated account credentials can reach participating merchants that hold cards on file or operate recurring payments. Mastercard's rules state that issuers communicate account changes through the updater ecosystem for qualifying recurring and account-on-file transactions.

That does not mean every merchant automatically receives every replacement card number.

Nor does the existence of an updater prove why a particular unauthorized transaction occurred.

That distinction is important.

But it does mean that a customer should not assume that changing the sixteen digits printed on the card necessarily destroys every existing digital relationship connected with the old card.

A replacement card and a clean break are not always the same thing.

Bank Alfalah itself offers card blocking, replacement and credit-card transaction dispute services through its customer-service infrastructure. Its fraud guidance tells customers to block a debit or credit card immediately, report suspected fraud and lodge a formal complaint.

Those are sensible first steps.

I would now add another.

Ask what happens to stored and recurring payment credentials when the replacement is issued.

What You Should Do If a USD 8 Transaction Appears

Suppose your bank has just replaced a compromised credit card.

A week later, you see USD 8 from a merchant you do not recognize or did not authorize.

Do not ignore it because the amount is small.

The important fact is not the value. The important fact is that a transaction you did not authorize has reached a card you believed was secure.

Start with the immediate security action. Block or freeze the affected card through the bank's official channel and contact the issuer. Bank Alfalah specifically advises customers who suspect fraud to block the card and report the matter immediately.

Then create a written record.

Take a screenshot of the transaction alert or statement entry. Record the date, merchant descriptor and amount. Keep the old complaint number if the card had already been compromised before replacement.

Do not send screenshots containing your full card number, CVV or passwords.

Now ask the bank a very precise question:

“Is this only a card replacement, or has the previous card-on-file/recurring-payment relationship also been terminated?”

That sentence changes the conversation.

If you previously dealt with the same merchant, tell the bank clearly that you no longer authorize payments from that merchant.

Ask the bank to register the new transaction as a formal disputed transaction. Do not settle for a telephone assurance that somebody will “look into it.”

Get a complaint or dispute reference number.

Then ask another question:

“Could the merchant have received updated card credentials through an account-updater, recurring-payment or stored-credential mechanism?”

You are not accusing the bank of using a particular mechanism. You are forcing the case into the correct technical area for investigation.

That matters.

Do Not Ask Only for Another Replacement Card

This is the mistake I now think cardholders should avoid.

If an unauthorized transaction survives one replacement, simply requesting replacement number two may not answer the underlying question.

Tell the bank what outcome you want.

For example:

“I do not authorize this merchant to receive or use updated payment credentials. Please investigate any stored-credential, recurring-payment or account-updater relationship associated with the old card and confirm in writing what action has been taken.”

That wording is much harder to misunderstand than saying, “My new card has been hacked.”

You should also contact the merchant named in the transaction where practical.

Ask whether it holds a card on file. Cancel any unwanted subscription from the merchant side and request written confirmation. A bank dispute and merchant cancellation address different parts of the problem.

Keep both records.

If the cardholder genuinely recognizes the merchant but disputes only the new charge, say so. If the merchant is completely unknown, say that instead.

Accuracy strengthens the dispute.

If Customer Service Keeps Answering the Wrong Question

My Bank Alfalah correspondence taught me another lesson.

Repeat less.

Structure more.

After the bank answered me about card delivery, I explained that delivery was irrelevant. When I was subsequently asked for a screenshot of an “error,” the mismatch became clearer.

At that stage, I would advise a customer to stop writing long narratives and ask point-by-point questions:

Was the old underlying account closed or was only the card replaced?

Were stored or recurring merchant credentials carried forward?

Has the unauthorized transaction been formally disputed?

What has been done to prevent the same merchant from charging again?

What is my complaint reference number?

Five direct questions create five things the bank must either answer or avoid answering.

The distinction becomes useful later.

Bank Alfalah says it acknowledges complaints within 48 hours and normally gives a final response within five working days, although investigations requiring more time can take longer. The bank also identifies Banking Mohtasib and SBP channels for escalation.

Pakistan's complaint framework generally requires the customer to approach the bank first. Banking Mohtasib says a customer can escalate after an unsatisfactory response or if the bank has not satisfactorily resolved the matter within the prescribed period.

SBP similarly advises customers to approach their bank first and preserve a chronology with supporting correspondence when escalating a banking complaint.

That is why written records matter so much.

A telephone call disappears into memory.

An email survives.

The USD 8 Was Small. The Question Was Not.

I could have ignored the transaction.

People lose more than USD 8 to exchange-rate movements, annual card fees or a restaurant bill they barely remember. Small amounts disappear easily inside a monthly statement.

But an unauthorized transaction carries different information.

It tells you that a payment path you believed had ended may still be alive.

My difficulty with Bank Alfalah was therefore not simply about recovering a few dollars. I was trying to establish whether replacing my card had actually severed the compromised payment relationship I had warned the bank about months earlier.

The answers I received initially concerned card delivery.

Then an imaginary “error.”

Neither addressed the question.

For cardholders, the lesson is uncomfortable but useful.

When fraud appears on a replacement card, do not ask only:

“Can you replace my card again?”

Ask something harder:

“What payment relationship survived the replacement, and how are you going to stop it?”

A new piece of plastic can arrive by courier.

The old digital relationship may require a different kind of closure.