Is it legal for a vendor to reuse credit details from a previous transaction
It is very much legal and in fact depending on the fine print of the purchase you make, you have now established a business relationship among which gives the business the right to hold on to your information (unless privacy policy states otherwise) and reuse it under certain circumstances (such as auto shipments) and when they called and asked you if you wanted it and you said OK, you acknowledged authorization. All legal even if pushy and less than pretty.
I've had a card cloned 15 years ago and used to buy over 5k of goods in another country. So the inconvenience of having a card closed and re-issued is quite annoying even though the charges were reversed and I was made whole. But these days most CC fraud isn't from a card scanned by a waiter and cloned then used elsewhere. Mostly it is poorly secured databases or point of sale terminal malware. The latter is getting curtailed by chipped cards and the largest source of fraud is now online transactions (so called card not present) where the merchant has your CC number. If their system is breached the bad guys have a wealth of card numbers they sell in an E-bay like site on the dark web. This is where the Citi virtual CC comes in handy. Here's how it works to protect the bank and the hassles you go through when a card as to be re-issued. Citi's virtual CCs let you generate an actual credit card, complete with security code and expiration date. What is unique is that once the virtual CC is used it can only be used subsequently by that same merchant and is declined by any other. You can also set a total limit on what the merchant can charge as well as an expiration date. I use them for all my online accounts because they are, for all practical purposes, immune to the malware that steals CC info. Even if somehow the virtual CC is used before the merchant makes the initial charge that locks in the CC to their account the charge can be reversed without closing your actual card which has a different number. You can manage multiple Citi virtual CCs and view charge status, close, or adjust limits over time so managing them is quite easy with no risk to your primary account. I think you're off base here.  The bureaus only remove information if the creditor cannot verify any dispute within 30 days, or if the information's super old.  If the creditor can provide corrected information, then the credit bureau is required to apply it to its own database.  A dispute can be about the entire account, or it can be about payment status within a given span (or spans) of time. Of course, it's the consumer who has to initiate the dispute. "Yes and No.  There's always a ""fee"".  The difference in credit vs debit usually determines how much that fee is and how it's paid.  Each vendor who accepts the major credit card is under contract to pay for equipment and meet certain standards.  The same is true for debt card transactions.  How much the ""fee"" is can vary based on the contract the vendor has with MasterCard/Visa/AMEX.  But in general most debt transactions go back to the bank who distributed the card." "As indicated in comments, this is common practice in the US as well as EU.  For example, in this Fox Business article, a user had basically the same experience: their card was replaced but without the specific merchant being disclosed.  When the reporter contacted Visa, they were told: ""We also believe that the public interest is best served by quickly notifying financial institutions with the information necessary to protect themselves and their cardholders from fraud losses. Even a slight delay in notification to financial institutions could be costly,” the spokesperson said in an e-mail statement. “Visa works with the breached entity to collect the necessary information and provides payment card issuers with the affected account numbers so they can take steps to protect consumers through independent fraud monitoring, and if needed, reissuing cards. The most critical information needed is the affected accounts, which Visa works to provide as quickly as possible.” What they're not saying, of course, is that it's in Visa's best interests that merchants let Visa know right away when a leak occurs, without having to think about whether it's going to screw that merchant over in the press.  If the merchant has to consider PR, they may not let the networks know in as timely of a fashion - they may at least wait until they've verified the issue in more detail, or even wait until they've found who to pin it on so they don't get blamed. But beyond that, the point is that it's easier for the network (Visa/Mastercard/etc.) to have a system that's just a list of card numbers to submit to the bank for re-issuing; nobody there really cares which merchant was at fault, they just want to re-issue the cards quickly.  Letting you know who's at fault is separate.  There's little reason for the issuing bank to ever know; you should find out from the merchant themselves or from the network (and in my experience, usually the former). Eventually you may well find out - the article suggest that: [T]he situation is common, but there is some good news: consumers do in many cases find out the source of the breach. But of course doesn't go into detail about numbers." "Your biggest risk with a vendor like this is not that your Credit Card Number will be stolen in transit, it is that it will be stolen from the vendor. I agree with @mhoran that using a one-time number is the best plan, provided you have a bank that offers such numbers.  Bank of America calls it ""Shop Safe"" while Citibank calls it ""Virtual Account Numbers"".  I think Discover card has something similar, but less useful, in that they aren't really one-time use, and I think American Express discontinued their service.  AFAIK no one else offers anything like it.  If you can't get a one-time number, then I was going to suggest buying a Visa gift card, until I put together the fact that you are making a purchase in Asia and the gift cards are not authorized for international payments (due to PATRIOT act restrictions).  Visa does offer the V.me service which might help, but I doubt your vendor participates (or would even be allowed to participate) if they don't offer a secure order form.  You can open a pre-paid Visa card account, which is probably what I'd do. You can buy pre-paid Visa cards the same way you buy Visa gift cards, the difference being you have to register the pre-paid cards (thanks, PATRIOT act) before you can use them.  But it's not that big a deal to register one, you just fill out the online form your your SSN etc and you're good to go. Load it up with enough money to cover your purchase and the FX fees and then cut it up." I have already talked to them over the phone and they insist they   haven't charged me yet, and I will not be charged. When I informed   them I had in fact been charged they agreed it would be reversed. So I   have tried to resolve the issue and I don't have any confidence they   will reverse the charge as it has not been done yet. They are   difficult to communicate which makes the whole process more difficult. Your best next step is to call the credit card company and share this story.  I believe the likely result is that the credit card company will initiate a charge back. My question is, is this a valid reason to file a chargeback on my credit card? Yes.   If you attempted to work it out with the vendor and it is not working out, this is an appropriate time to initiate a charge back. "In the United States, the Fair Credit Reporting Act allows companies to buy your credit information for ""legitimate business needs."" The legitimate use of credit scores and credit reporting varies state to state, but like it or not, you can expect a lot more non-lending use of your credit information in the future. Companies and individuals use credit reports as an assessment of general behavior because, unfortunately, they work. You've seen the disclaimers about ""past performance…"", but unfortunately in this case… past performance really has been shown to be a pretty reliable indicator of future behavior. So…" There are rules and regulations as to how the credit card information must be stored, and I assume Square adhere to these rules. The point is that the barber doesn't need to see your credit card at all, and doesn't have to keep its number for keeping tabs, you only share the information with Square and they remit payments to everyone else. This is very similar to Paypal, Amazon and Google checkout systems, except that Square combine it with physical card processing. When you give your credit card number and authorize a merchant to charge your credit card, the merchant then gives the information to their merchant processor which in turns bills the bank that issued the card (it's a little more complex and it all happens instantly unless the merchant is using the very old fasion imprinting gizmos). It is possible for a merchant to attempt to charge you more than you authorized but if they do they risk a fine ($25-$50 for a chargeback) from their processor, the legitimate portion of the charge as well as increasing the processing fees charged by their processor or even the possibility of loosing their merchant account entirely and being permanently blacklisted by Visa/Mastercard. In short no legitimate business is going to intentionally over charge your credit card.  There really isn't significant risk in using a reputable online retailer's order forms. There is the possibility that their database could be compromised but that risk is lower than the risk of having an employee steal your credit number when you give it to them in person. Besides in the US at least the most you can legally be held liable for is $50 assuming you notice the discrepancy within 60 days of statement the charge appears on and most banks limit liability to $0.  Over the years I have had a number of different credit card numbers stolen and used fraudulently and I have never had to pay any fraudulent charges. "A bona-fide company never needs your credit card details, certainly not your 3-digit-on-back-of-card #, to issue a refund.  On an older charge, they might have to work with their merchant provider.  But they should be able to do it within the credit card handling system, and in fact are required to.  Asking for details via email doesn't pass the ""sniff test"" either.  To get a credit card merchant account, a company needs to go through a security assessment process called PCI-DSS. Security gets drummed into you pretty good.  Of course they could be using one of the dumbed-down services like Square, but those services make refunds ridiculously easy.   How did you come to be corresponding on this email address?  Did they initially contact you?  Did you find it on a third party website?  Some of those are fraudulent and many others, like Yelp, it's very easy to insert false contact information for a business. Consumer forums, even moreso.  You might take another swing at finding a proper contact for the company.  Stop asking for a cheque.  That also circumvents the credit card system.  And obviously a scammer won't send a check... at least not one you'd want!  If all else fails: call your bank and tell them you want to do a chargeback on that transaction.  This is where the bank intervenes to reverse the charge.  It's rather straightforward (especially if the merchant has agreed in principle to a refund) but requires some paperwork or e-paperwork.   Don't chargeback lightly.  Don't use it casually or out of laziness or unwillingness to speak with the merchant, e.g. to cancel an order.  The bank charges the merchant a $20 or larger investigation fee, separate from the refund.  Each chargeback is also a ""strike""; too many ""strikes"" and the merchant is barred from taking credit cards. It's serious business.   As a merchant, I would never send a cheque to an angry customer.  Because if I did, they'd cash the cheque and still do a chargeback, so then I'd be out the money twice, plus the investigation fee to boot." "To answer the heart of your question, it would be illegal for any credit bureau or creditor to somehow ""penalize"" you just for trying to make sure that what's being reported about you is accurate.  That's why the Fair Credit Reporting Act exists -- that's where the rights (and mechanisms) come from for letting you learn about and request accurate reporting of your credit history. Every creditor is responsible for reporting its own data to the bureaus, using the format provided by those bureaus for doing so. A creditor may not provide all of the information that can be reported, and it may not report information in as timely a manner as it could or should (e.g., payments made may not show up for weeks or even months after they were made, etc.). The bottom line is that the credit bureaus are not arbiters of the data they report.  They simply report.  They don't draw conclusions, they don't make decisions on what data to report.  If a creditor provides data that is within the parameters of what the bureaus ask to be provided, then the bureaus report precisely that -- nothing more, nothing less. If there is an inaccuracy or mistake on your report, it is the fault (and responsibility) of the creditor, and it is therefore up to the creditor to correct it once it has been brought to their attention.  Federal laws spell out the process that the bureau has to comply with when you file a dispute, and there are strict standards requiring the creditor to promptly verify valid information or remove anything which is not correct. The credit bureaus are simply automated clearinghouses for the information provided by the creditors who choose to subscribe to each bureau's system.  A creditor can choose which (or none) of the bureaus they wish to report to, which is why some accounts show on one bureau's report on you but not another's. What I caution is, just because a credit bureaus reports on your credit doesn't mean they have anything to do with the accuracy or detail of what is being reported.  That's up to the creditors." "It's very straightforward for an honest vendor to refund the charge, and the transaction only costs him a few pennies at most.  If you initiate a chargeback, the merchant is immediately charged an irreversible fee of about $20 simply as an administrative fee.  He'll also have to refund the charge if it's reversed.  To an honest merchant who would've happily refunded you, it's unfair and hurtful.  In any case, now that he's out-of-pocket on the administrative fee, his best bet is to fight the chargeback - since he's already paid for the privilege to fight. Also, a chargeback is a ""strike"" against the merchant.  If his chargeback rate is higher than the norm in his industry, they may raise his fees, or ban him entirely from taking Visa/MC.  For a small merchant doing a small volume, a single chargeback can have an impact on his overall chargeback rate.  The ""threshold of proof"" for a chargeback varies by patterns of fraud and the merchant's ability to recover.  If you bought something readily fungible to cash - like a gift card, casino chips, concert tickets etc., forget it.  Likewise if  you already extracted the value (last month's Netflix bill).  Credit card chargeback only withdraws a payment method.  Your bill is still due and payable. The merchant is within his rights to ""dun"" you for payment and send you to collections or court.  Most merchants don't bother, because they know it'll be a fight, an unpleasant distraction and bad for business.  But they'd be within their rights.  Working with the merchant to settle the matter is a final resolution." "It surely doesn't HURT to keep a receipt. I tend to pile up receipts in my desk drawer, never look at them, and then every few months throw them all out. If a vendor writes a receipt by hand or if the cash register is not tied in to the credit card system, keeping a receipt could give you evidence against mistakes or fraud. Like if the vendor gives you a receipt for $10 and then sends a transaction to the credit card company for $20, you could use the receipt as evidence of the problem. But if the vendor is trying to really cheat you, the most likely thing for him to do is run the legitimate transaction through, and then some time later run a fake transaction. So say today you go to vendor X, buy something for $20, and he bills your credit card $20. Then a few days later he bills you another $100 even though you never came back to the store. Sure, you have a receipt for $20. But you don't have a receipt for the $100 because you never authorized that transaction. Your receipt proves nothing -- presumably you're not disputing the $20. If you complain to the bank or go to the police or whatever, saying, ""Hey look, I don't have a receipt for the $100"" doesn't prove anything. How do they know you didn't just throw it away? It's difficult to prove that you never had such a receipt." "Here's an excerpt from VISA's Card Acceptance Guidelines for Visa Merchants (PDF)  The merchant name is the single most important factor in cardholder   recognition of transactions. Therefore, it is critical that the   merchant name, while reflecting the merchant’s “Doing Business As”   (DBA) name, also be clearly identifiable to the cardholder. This can   minimize copy requests resulting from unrecognizable merchant   descriptors. Merchant applications typically list the merchant name as the merchant   DBA. This may differ from the legal name (which can represent the   corporate owner or parent company), and may differ from the owner’s   name which, for sole proprietorships, may reflect the business owner. I think that the key statement above is ""Therefore, it is critical that the merchant name [...] be clearly identifiable to the cardholder."" Since this merchant was not clearly identifiable to the cardholder, they are in breach of a critical point in these guidelines. This is from VISA, but I would assume that all other major credit cards would have similar guidelines for their merchants. However keep in mind that these are ""guidelines"", and not (necessarily) rules." It sounds like the items shipped directly from the vendor need to be recorded into your system when the order is confirmed, that way cost of goods sold and revenue don't get lost. You'll have a record of re-orders and cancels and other such things too.