This site is an independent educational resource. We are not a bank, card issuer, payment processor, financial advisor, or affiliate of any merchant or issuer mentioned. Information about Regulation E (12 CFR 1005), Regulation Z (12 CFR 1026), Regulation II (12 CFR 235), the Electronic Fund Transfer Act, and the Truth in Lending Act is sourced from the Consumer Financial Protection Bureau, the Federal Reserve, and the Federal Trade Commission as of April 2026. Rules change; verify with your card issuer or a licensed advisor before acting. Nothing on this site is personalised legal, tax, or financial advice.

creditcardvsdebitcard.com
🔁Use Credit

Updated May 2026

Credit vs Debit for Recurring Subscriptions: the cancel-the-gym problem

Cancelling the credit card does not stop the gym from billing. Visa Account Updater pushes the new card number to the gym within days of reissue. Reg Z (12 CFR 1026.13) covers the cancelled-but-still-billed charge as a billing error. Reg E does not. The structural difference shows up clearly on subscription products.

Why cancelling the card does not stop the billing

Two opt-in services run by the card networks keep merchants in sync with reissued card numbers. Visa Account Updater (VAU) and Mastercard Automatic Billing Updater (ABU) push the new primary account number to enrolled merchants whenever the issuer reissues a card, whether because of expiry, theft, or account closure with the same consumer. For most US subscription merchants (streaming services, gym chains, SaaS products, recurring grocery delivery, recurring meal kits), enrolment in VAU and ABU is the default.

The practical consequence: a consumer who cancels their card to end an unwanted gym subscription will, within 1 to 7 days of receiving a reissued card, see the new card number begin billing for the same gym membership. The gym's billing system pulls the updated card number from the network without any consumer action. The consumer has not cancelled the membership contract, only changed the payment instrument, and the membership contract is what the gym is enforcing.

The exception: a consumer can opt out of VAU or ABU at the issuer level. Most major US issuers expose this as a per-merchant block (the consumer flags a specific merchant for non-update) rather than as a global opt-out. Chase, Capital One, American Express, and Citi all support per-merchant blocks via the mobile app. The block is per-merchant, not per-subscription category, so the consumer needs to know exactly which merchant identifier the gym uses on the statement.

The three subscription-cancellation paths, ranked by reliability

  1. Cancel via the merchant directly. Send the cancellation request following the merchant's published process. Get a confirmation number or email. This ends the contract. The merchant has no legal right to bill after cancellation.
  2. Cancel via the merchant + block at the issuer. If the merchant continues to bill despite a confirmed cancellation, block the merchant at the issuer using the per-merchant block feature. This stops future authorisations from posting.
  3. Dispute the charges that already posted. File a Reg Z billing-error claim under 12 CFR 1026.13(a)(3) for each post-cancellation charge. Each is a separate dispute. Provide the cancellation confirmation as supporting evidence.

Cancelling the card without doing any of the above is the least effective option. The merchant gets the new card number within days; the original contract is still in force; the consumer has nothing in writing to support a future dispute beyond a request to reissue a card.

ROSCA and the Restore Online Shoppers' Confidence Act

The Restore Online Shoppers' Confidence Act (ROSCA, 15 USC 8401-8405) was enacted in 2010 to address two specific online subscription abuses: negative-option billing without clear consent, and post-transaction marketing where a third-party offer is bundled into a checkout flow with shared payment information. ROSCA requires that online sellers clearly disclose all material terms of a transaction before charging, obtain the consumer's express informed consent, and provide a simple mechanism to stop recurring charges.

ROSCA is enforced by the Federal Trade Commission and is the legal backbone of most FTC enforcement actions against subscription merchants over the past decade. A merchant that fails to disclose recurring billing terms, makes cancellation harder than signup, or hides cancellation behind a customer service phone line with extended wait times is exposed to FTC enforcement. ROSCA itself does not give the consumer a private right of action, but the FTC has used it to obtain consumer restitution in major cases (the agency's 2023 settlement with Vonage included $100 million in consumer refunds for cancellation friction).

For the consumer, the practical relevance of ROSCA is twofold. First, the consumer's cancellation right is a federal statutory right under 15 USC 8403(2), not a discretionary merchant policy. A merchant that obstructs cancellation is violating federal law. Second, the consumer can file a complaint at reportfraud.ftc.gov to add to the regulator's casebook against the merchant. Aggregated complaints are how the FTC selects enforcement targets.

ROSCA applies to both credit and debit transactions. The card type does not affect the consumer's ROSCA rights. The card type does affect the consumer's recovery path while the FTC case (which can take years to settle) is pending. With a credit card, the consumer can dispute each post-cancellation charge under Reg Z and the issuer is required to withhold the charge during the investigation. With a debit card, the consumer waits for a discretionary chargeback while the cash sits with the merchant.

The merchant-initiated transaction framework

In 2018, Visa and Mastercard introduced merchant-initiated transaction (MIT) flagging across the global authorisation network. MIT is a flag on the transaction message that tells the issuer this is not a cardholder-present, cardholder-initiated transaction. Instead, it is a merchant submitting a charge based on a pre-existing agreement with the cardholder (the subscription signup).

MIT does not change the consumer's legal rights. It changes the issuer's fraud-scoring engine. Before MIT, an issuer's fraud-scoring engine had no clean way to distinguish a recurring subscription charge from a card-not-present fraud attempt. Both looked similar: a merchant submitting a charge without the cardholder online. The fraud engine flagged some legitimate recurring charges as fraud, declining them and creating a "broken billing" inconvenience for the cardholder. The MIT flag tells the engine "this is a known recurring relationship, accept by default."

The MIT flag is what allows VAU and ABU to keep updating the card number. Without an MIT flag, a card-network rule would have required the merchant to send the cardholder a new authorisation request after a card reissue. With the MIT flag, the merchant can continue billing the new card number indefinitely as long as the underlying subscription contract remains active.

From the consumer's perspective, MIT is a quiet structural rule that explains why "I just cancelled the card" never works as a long-term subscription escape. The structural fix is to cancel the contract with the merchant, not the card with the issuer. The dispute path, when the merchant misbehaves, is Reg Z on credit or a discretionary chargeback on debit.

Free-trial conversion: where the disputes actually happen

Free-trial-to-paid conversion is the highest-dispute scenario in the subscription economy. The consumer signs up for a 7-day or 30-day free trial, intends to cancel before the trial expires, forgets, and is auto-charged the first full subscription period at the end of the trial. The dispute arrives at the issuer with the consumer claiming the charge was unauthorised. The merchant's defence is the consumer's electronic signature on the original signup, which included consent to auto-conversion.

The merchant usually wins these disputes when the cancellation flow was clearly disclosed at signup. The consumer usually wins when the merchant's signup flow buried the auto-conversion terms in fine print, or when the cancellation mechanism was not the "simple mechanism" required by ROSCA 15 USC 8403(3). For credit-card users, the Reg Z investigation has a 90-day clock and the charge is withheld during the investigation, so the consumer's financial exposure is zero while the dispute resolves. For debit-card users, the cash is already gone, the chargeback is discretionary, and the resolution timeline is at the bank's discretion.

The defensive practice that works for both card types: keep a calendar reminder for any free-trial signup, set for the day before the trial ends, with the merchant's cancellation URL in the calendar note. Cancellation friction is asymmetric; the merchant designs the cancellation flow to be slow. A reminder 24 hours before the trial converts gives the consumer time to navigate the cancellation flow before the auto-conversion fires.

Common questions

Can I stop a subscription by cancelling my card?▼
Sometimes, but not reliably. Visa Account Updater and Mastercard Automatic Billing Updater push the new card number to merchants automatically when the issuer reissues a card (theft, expiry, account change). Most major US subscription merchants enrol in the updater services, so a cancelled-and-reissued card will continue to bill within 1 to 7 days of reissue.
What is the difference between cancelling the subscription and disputing the charge?▼
Cancellation is a contract action between consumer and merchant: the consumer ends the future billing relationship. Dispute is a payment-network action: the consumer claims a specific past charge was incorrect, undelivered, or unauthorised. For credit cards, the dispute path is the Reg Z billing-error claim under 12 CFR 1026.13. For debit cards, dispute is generally voluntary through the network unless the EFT itself was unauthorised under Reg E.
How does Reg Z apply to a subscription that keeps charging after I cancelled?▼
Reg Z 12 CFR 1026.13(a)(3) covers transactions reflecting goods or services not delivered to the consumer as agreed. If the consumer cancelled the gym membership and the gym continues to bill the credit card, those charges are billing errors under Reg Z because the consumer is being charged for services not agreed to. The consumer notifies the issuer in writing within 60 days of the statement showing the disputed charge; the issuer has 90 days to investigate.
Can I dispute a subscription charge on a debit card?▼
Possibly, but not as a statutory right under Regulation E. Reg E 12 CFR 1005.11 covers EFT errors, not whether goods or services were delivered. Many debit issuers extend voluntary chargeback rights under Visa or Mastercard network rules to debit transactions, but this is discretionary. The bank can refuse, and the consumer's checking account remains debited until any provisional credit posts.
What is a merchant-initiated transaction?▼
A merchant-initiated transaction (MIT) is a transaction the merchant submits to the card network without the cardholder being present, based on a pre-existing agreement (the original subscription signup). Visa and Mastercard introduced MIT flagging in 2018 to give issuers cleaner signals about which recurring charges are authorised. The MIT framework does not affect the cardholder's dispute right, but it does affect how the issuer's fraud-scoring engine treats the charge.

Related on this site

Subscriptions overviewOnline ShoppingFraud Liability ComparedReg E vs Reg ZGlossary: Merchant-Initiated TransactionsCase study: late subscription dispute

Sources verified May 2026

Informational summary, not financial or legal advice. CFR sections cited are current as of May 2026.