Subscriptions and Recurring Billing
Before optimizing recurring billing, understand:
- Auth optimization and retry logic
- Decline codes and soft vs. hard decline handling
- Chargeback prevention for subscription disputes
- Descriptors and communication for recognition
Subscription payments fail differently than one-time payments. The difference between 90% and 95% billing success is 5% of your recurring revenue. On $100k MRR, that's $5k/mo walking out the door.
Most subscription businesses accept their decline rate as fixed. It isn't.
What Matters
- Card-on-file consent is non-negotiable. No consent documentation = lost disputes.
- Account updater (CAU) is free money. If you're not using it, you're losing 2-4% of billings to expired cards. See increase auth rates playbook.
- Dunning sequence design separates amateurs from pros. When you retry, how you communicate, and when you stop all affect recovery.
- Hard vs. soft decline logic. Retry the wrong decline code and you burn issuer goodwill.
- Cancellation proof wins disputes. If a customer says they cancelled and you can't prove they didn't, you lose. See compelling evidence.
Card-on-File Requirements
Storing cards for future billing requires explicit consent. This isn't optional.
What Consent Must Include
- Clear disclosure that you're storing the card
- Explanation of what you'll charge and when
- Cancellation terms
- Customer acknowledgment (checkbox, signature, click-through)
What to Save
| Data Point | Why |
|---|---|
| Consent timestamp | Proves when they agreed |
| IP address | Links consent to a device |
| Consent language version | Shows what they agreed to |
| Transaction ID of first charge | Ties consent to billing relationship |
Issuer View
When we see a dispute on a recurring charge, the first thing we check is whether the merchant can prove consent. A timestamped signup flow with clear billing terms usually wins. A vague "I think they signed up" loses.
Card Account Updater (CAU)
CAU automatically updates stored cards when issuers reissue them. Visa calls theirs VAU (Visa Account Updater). Mastercard calls theirs ABU (Automatic Billing Updater).
What CAU Fixes
- Expired cards
- Reissued cards (new number, same account)
- Changed expiration dates
What CAU Does Not Fix
- Closed accounts
- Fraud blocks
- Customer-initiated cancellations
- Cards the customer doesn't want you to charge
When to Enable
Nearly always. If you bill recurring, enable CAU. The ROI is immediate.
How to Check If You Have It
"Is Card Account Updater enabled on our merchant account? Are we receiving and applying updates before billing?"
Most processors support CAU, but it may not be enabled by default. Some charge per update (typically $0.25-$0.50 per hit). Others include it.
Measuring CAU Lift
Compare involuntary churn before and after enabling:
- Pull 3 months of data before CAU
- Enable CAU
- Pull 3 months after
- Calculate the delta in expired-card failures
Typical lift: 2-4% reduction in failed recurring billings.
Dunning Sequences
Dunning is what happens after a payment fails. Your sequence determines how much revenue you recover.
Anatomy of a Dunning Sequence
| Step | Timing | Action |
|---|---|---|
| 1 | Immediately | Retry payment |
| 2 | Day 1 | Email: "Payment failed, update card" |
| 3 | Day 3 | Retry payment |
| 4 | Day 3 | Email: "Still having trouble" |
| 5 | Day 7 | Retry payment |
| 6 | Day 7 | Email: "Service at risk" |
| 7 | Day 14 | Final retry |
| 8 | Day 14 | Email: "Last chance before cancellation" |
| 9 | Day 21 | Cancel or pause |
Retry Timing That Works
Don't retry immediately after failure. Wait.
- Soft decline (insufficient funds): Retry in 3-5 days. Paydays matter.
- Issuer unavailable: Retry in 4-24 hours.
- Card expired without CAU update: Don't retry. Email for new card.
Email Timing That Works
- Day 1: Factual. "Your payment failed. Here's how to update."
- Day 3-7: Helpful. "Want to keep access? Update here."
- Day 14+: Urgent but not aggressive. "We'll pause your account in 3 days."
What Kills Recovery
- Too many emails (3-4 total is enough)
- Aggressive tone ("PAY NOW OR ELSE")
- No clear update link
- Retrying hard declines repeatedly
Hard vs. Soft Decline Logic
Not all declines are equal. Retry logic should match decline type.
Soft Declines: Retry-Eligible
| Code | Meaning | Retry Strategy |
|---|---|---|
| Insufficient funds | Account low | Retry in 3-5 days (around payday) |
| Issuer unavailable | Technical issue | Retry in 4-24 hours |
| Card not activated | New card | Retry in 1-2 days |
| Exceeds limit | Over spending limit | Retry in a few days |
Hard Declines: Do Not Retry
| Code | Meaning | Action |
|---|---|---|
| Card stolen/lost | Fraud flag | Stop. Request new card. |
| Invalid card number | Card doesn't exist | Stop. Request new card. |
| Card expired | CAU should have caught this | Stop. Request new card. |
| Do not honor | Issuer says no | Try once more, then stop. |
| Restricted card | Blocked category | Stop. Different card needed. |
Why This Matters
Issuers track retry behavior. Merchants who hammer declined cards get worse auth rates across all transactions. One bad retry pattern can tank your entire approval rate.
"What's our retry logic for soft declines vs. hard declines? Are we distinguishing between them?"
The Dunning End Game
When do you stop trying?
When to Stop Retrying
| Model | Stop After |
|---|---|
| SaaS / digital service | 14-21 days of failure |
| Physical subscription (box) | 7-14 days (you have fulfillment costs) |
| High-ticket service | 30 days (worth the chase) |
Cancel vs. Pause
| Action | When to Use |
|---|---|
| Cancel | Low LTV customers, free trial churners, abuse patterns |
| Pause (unpaid hold) | High LTV customers, long tenure, seasonal businesses |
Pausing preserves the relationship. Cancelling ends it. Choose based on customer value.
Grace Period Strategy
- Free trials: No grace. Card fails = trial ends.
- Paid subscriptions: 7-14 day grace is standard.
- Enterprise/annual: 30+ days. These are worth saving.
After the Last Retry Fails
"What happens after our last retry fails? Does the subscription cancel, pause, or just sit there?"
"Sits there" is the wrong answer. Define the end state.
Stop Using $0/$1 Auth to Save Cards
If you're still using $0 or $1 authorizations to validate cards before saving them, stop.
The Old Pattern
- Customer enters card
- Authorize $0 or $1 to "validate"
- Void the auth
- Save the card for future billing
Why This Fails
- Higher decline rates. Issuers are suspicious of $0/$1 auth patterns.
- Customer confusion. "Why is there a $1 charge?"
- Worse issuer acceptance. You look like a card tester.
The Modern Approach
Use SetupIntent-style flows (Stripe calls it SetupIntent, others have equivalents).
- Validates the card without a charge
- Designed for card-on-file use cases
- Better issuer acceptance
- No customer-facing charge
"Are we still using $0/$1 auth to save cards? Can we switch to SetupIntent or equivalent?"
Subscription Fraud Typologies
Recurring billing attracts specific fraud patterns.
Trial Abuse
Pattern: Sign up for free trial, cancel before charge, repeat with new email/card.
Signals:
- Device fingerprint matches previous trial user
- Disposable email domain
- Card BIN cycling (same first 6 digits, different cards)
- VPN or proxy use
Response:
- Limit trials to one per device fingerprint
- Block disposable email domains
- Require payment method at trial start (not $0 auth, use SetupIntent)
Promo Stacking
Pattern: Abuse referral codes, coupons, or first-month discounts.
Signals:
- Same billing address, different names
- Referrer and referee from same IP
- Multiple accounts created rapidly
Response:
- Limit referral rewards per payment method
- Velocity checks on promo code use
- Link detection across accounts
Credential Sharing/Reselling
Pattern: One paid account shared among many users, or resold access.
Signals:
- Logins from many IPs/locations simultaneously
- Usage patterns that don't match single-user behavior
- Account credentials appearing on resale sites
Response:
- Concurrent session limits
- Device registration caps
- Usage-based lockouts
Related: Fraud Prevention
Subscription Dispute Patterns
Recurring billing has unique dispute characteristics.
Common Dispute Reasons
| Reason | Cause | Prevention |
|---|---|---|
| "I cancelled" | They didn't, or you didn't process it | Clear cancellation flow, confirmation emails |
| "I didn't authorize this" | They forgot, or genuine fraud | Pre-renewal reminders, clear descriptors |
| "I didn't recognize the charge" | Bad descriptor | Include brand name in descriptor |
| "I was charged after cancelling" | Billing/cancellation timing mismatch | Stop billing immediately on cancel |
Cancellation Proof Basics
When a customer disputes saying they cancelled, you need:
- Cancellation policy they agreed to at signup
- Usage logs showing activity after alleged cancellation
- Communication history (did they contact support?)
- Account status timeline (when did they actually cancel?)
If you can't prove they didn't cancel, you lose.
Pre-Renewal Reminders
For annual subscriptions, send a reminder 7-14 days before renewal:
"Your subscription renews on [date] for [amount]. If you want to cancel, [click here]."
This feels scary but reduces disputes. A customer who cancels is better than a customer who disputes.
Involuntary vs. Voluntary Churn
Churn has two causes. Fix the right one.
Involuntary Churn (Payment Failure)
- Card expired
- Insufficient funds
- Card replaced
- Issuer decline
Fix with: CAU, dunning optimization, retry logic, payment method diversity.
Voluntary Churn (Customer Choice)
- Didn't need the product
- Found alternative
- Price objection
- Bad experience
Fix with: Product, pricing, onboarding, support. Not payments.
Measuring the Split
Track churn by cause:
- What percentage of churned customers had a failed payment as their last event?
- What percentage voluntarily cancelled with a working card?
If involuntary churn is >30% of total churn, your payments infrastructure is the problem.
Test to Run
4-week CAU and dunning audit:
Week 1: Baseline your current metrics.
- Involuntary churn rate
- Retry success rate by attempt number
- CAU hit rate (if enabled)
Week 2-3: Implement changes.
- Enable CAU if not active
- Adjust retry timing based on decline codes
- Update dunning emails
Week 4: Measure.
- Compare involuntary churn to baseline
- Track recovery rate by dunning step
Success criteria: 10-20% reduction in involuntary churn within 30 days.
Scale Callout
| Volume | Focus |
|---|---|
| Under $100k MRR | Enable CAU, set up basic dunning (3-4 emails), don't overthink it. |
| $100k-$1M MRR | Optimize retry timing by decline code, A/B test dunning emails, track recovery by step. |
| Over $1M MRR | Dedicated retention ops, predictive churn models, custom dunning by customer segment and LTV. |
Where This Breaks
-
Prepaid cards. No CAU. Can't retry. Just fails. Consider requiring non-prepaid for subscriptions.
-
Corporate cards with frequent reissuance. B2B subscriptions on company cards churn hard. Get backup payment methods or invoice them.
-
Customers who want to cancel but dispute instead. Some customers find disputing easier than cancelling. Make cancellation brain-dead simple to reduce this.
Analyst Layer: Metrics to Track
| Metric | What It Tells You | Target |
|---|---|---|
| Involuntary churn rate | Payment-driven churn | < 3% monthly |
| Retry success rate | Dunning effectiveness | > 30% recovery |
| CAU hit rate | Updater coverage | > 5% of active cards |
| Dunning email open rate | Message effectiveness | > 40% |
| Recovery by attempt | Optimal retry count | Most recovery by attempt 2-3 |
| Churn by decline code | Where to focus | Hard declines should be < 20% of failures |
Recurring Churn Analytics Framework
Track these dimensions to understand where you're losing subscribers:
| Dimension | Metrics to Track | Why It Matters |
|---|---|---|
| Churn type | Voluntary vs involuntary | Different fixes for each |
| Churn timing | Days since signup when churn occurs | Identifies risk periods |
| Decline reason | Distribution of decline codes | Tells you what's fixable |
| Recovery rate | % recovered by dunning step | Shows where dunning works |
| LTV at churn | Revenue lost per churned sub | Prioritizes retention effort |
Monthly churn decomposition:
Total churn = Voluntary + Involuntary
Involuntary = Declined + Expired + Blocked + Other
Declined = Hard decline (unfixable) + Soft decline (retry-able)
Key ratios:
- Involuntary / Total churn (target: < 30%)
- Soft decline / Total declined (target: > 60%)
- Recovered / Soft declined (target: > 40%)
CAU Lift Measurement
Quantify your Card Account Updater ROI:
| Metric | How to Calculate | Benchmark |
|---|---|---|
| CAU coverage | Subscribers with updatable cards / Total subscribers | 70-85% |
| Update rate | CAU updates received / Billing attempts | 2-5% monthly |
| Prevented churn | (Updates that would have failed) × billing success rate | Track monthly |
| CAU ROI | (Prevented churn × LTV) - (Updates × cost per update) | Should be > 10x |
Before/after analysis:
- Baseline 3 months of expired card failures before CAU
- Enable CAU for 3 months
- Compare expired card failure rate
- Calculate LTV of saved subscribers
Expected lift: 2-4% reduction in involuntary churn, or 10-20% of expired-card failures prevented.
Cohort Analysis
Track cohorts by:
- Signup month
- Payment method type
- Pricing tier
Identify which cohorts have highest involuntary churn and fix those first.
Next Steps
Just starting with subscriptions?
- Audit your consent capture → Do you have documented proof of recurring authorization?
- Enable Card Account Updater (CAU) → Free lift to billing success
- Set up basic dunning → Email on first failure, retry in 3 days
Improving billing success?
- Segment declines by type → Soft vs. hard, expired vs. insufficient funds
- Optimize retry timing → Match to payday cycles for B2C
- Review auth optimization → Decline patterns affect recurring
Fighting subscription chargebacks?
- Check compliance requirements → Network rules for recurring
- Improve cancellation flow → Easy cancellation = fewer disputes
- Pre-billing notifications → Remind before charging, not after
Related Pages
- Compliance: Subscription Rules - Network requirements
- Chargeback Prevention - Dispute reduction
- Refund Strategy - When to refund
- Fraud Prevention - Fraud patterns
- Descriptors and Communication - Billing clarity
- Buying Payments - Token portability
- Auth Optimization - Decline patterns
- Increase Auth Rates - Retry optimization
- Decline Codes - Soft vs. hard declines
- Compelling Evidence - Proving consent
- Promo Abuse - Trial abuse patterns
- Device Fingerprinting - Multi-account detection