Payments glossary
Card-on-file
Card-on-file is the practice of storing a customer's card details - as a secure token - with their consent, so future payments can be made without the card being re-entered. It powers one-click checkout, subscriptions and merchant-initiated billing.
Storing cards the right way
Card-on-file means keeping a customer's payment credentials for future use - but no responsible merchant stores actual card numbers. The card is tokenised on first use: the real details go into a PCI DSS-compliant vault and the merchant keeps only a token. Consent is captured at the moment of storage, as scheme rules require and POPIA's approach to personal information reinforces. From then on the stored credential can fund one-click checkout, subscriptions and account top-ups.
CIT and MIT: who presses the button
Stored-credential payments split into two families under scheme rules. Customer-initiated transactions (CITs) happen with the customer present - clicking "pay" against a saved card - and can be authenticated with 3-D Secure. Merchant-initiated transactions (MITs) happen without the customer, such as a subscription renewing overnight, under an agreement established during an authenticated first payment. Flagging each correctly matters: issuers treat properly indicated MITs far more kindly than unexplained charges with no cardholder in sight.
Keeping stored cards alive
Cards on file decay - they expire, get reissued after fraud, or are replaced by the bank - and every stale credential is a failed renewal waiting to happen. Mitigations include prompting customers to update details, intelligent retry timing, and, as an industry direction, network tokens that follow the card through reissue. LekkaPay's tokenisation provides card-on-file storage with the vault, consent capture and CIT/MIT indicators handled by the platform.
Last updated:
Payments without the jargon.
One integration, every way Africa pays - we'll handle the acronyms.