Online grocery unilaterally changes debit card details to a card my bank haven't even sent me yet

revrob77

Last week a doorstep food delivery company informed me by email that an attempt by them to collect payment for my next week's deliveries, had failed. Cutting a long story short, I discovered from my bank, that the grocery vendor, as my card on their system only had just over a month to run, had contacted VISA to get the new card details (the new card hasn't even been issued yet) and then they had altered the card details on my online grocery account, and use them to attempt, unsuccessfully, to take the next week's payment from my bank. Until I was able to contact my bank and get details of the failed transactions, I was concerned about whether the grocery website, or my own computer had suffered a hack or data breach, whether my online banking had been compromised or whether a new debit card had gone astray in the post.
I then changed the debit card details on the grocery site, back to the old card, and the payment eventually went through as normal.
My bank, who were very helpful, said that it was normal for an online vendor to contact VISA to get new card details, as an old card expired, but it looked like this vendor had "jumped the gun" by changing the stored card details, much too early, before the new card had even been posted, and while the old card was still in use.

I've never come across this before. Anyone got any comments or have you experienced something similar?

DullGreyGuy

revrob77 said:

My bank, who were very helpful, said that it was normal for an online vendor to contact VISA to get new card details, as an old card expired, but it looked like this vendor had "jumped the gun" by changing the stored card details, much too early, before the new card had even been posted, and while the old card was still in use.

I've never come across this before. Anyone got any comments or have you experienced something similar?

Its not only "normal" its generally a requirement for any company that uses continuous payment authority to use the "card updater service" offered by Visa, Mastercard and AmEx (not sure if Discovery and other minority cards have similar systems).

Its been over 15 years since I last dealt with the service and it was only a couple of years old at that point (so its been around a long time). Before you take a CPA payment you are supposed to check that the card number you hold is still valid. In my day this was done by once a day sending a file of all the card numbers you intended to bill in the following week to your acquiring bank. The merchants acquiring bank then returns a file with a marker against each one:

1) Proceed with this card
2) Use this new card number 1234 1234 1234 1234
3) Dont process payment - reason code X

The merchant's system should then do what the file says, use the existing number, use the new number the system has given or stop the payment. X could be things like closed account, changed network, fraud etc

I cannot remember if there was any date component, ie us telling the system what date we are going to make the payment for the response to factor in a future change or not.. from memory there wasnt but that either could be wrong or could be something thats changed.


So yes, perfectly normal, many companies use it. Clearly something went wrong in this case but you managed to resolve it.