How to protect myself against unauthorized recurring CC charges?
"The bank SHOULD be able to issue you a new card without letting vendors roll over the recurring payments. In fact, I've never had a bank move recurring payments to a new card automatically, or even upon request; they've always told me to contact the vendor and give them my new card number. So go back to the bank, tell them specifically that you have a security issue and you want the new card issued WITHOUT carrying over any recurring charges, and see if they can do it properly. If not: 1) Issue a ""charge back"" every time a bogus charge comes in. This costs the vendor money, and should convince them to stop trying to access your card. It's a hassle because you have to keep contacting the bank about the bad charges, but it won't cost you more than time and a phone call or letter.  (The bank can tell you what their preferred process is for this.) 2) Consider moving to a bank that isn't stupidly over-helpful." "There is no way to stop any merchant from setting a recurring charge flag on a purchase. According to the following article, Mastercard and Visa encourages merchants to use this feature and even give them a better rate. I have found it impossible to stop these unauthorized transactions.  The article sites that the merchant is allowed to march the charges across expired cards to find a good card that you might have as well as the article states they can cross banks to find you if you have the same type of card. Virtual account numbers will not protect you. Sorry but the only solution I have found is to close the account with the bank and move to a different type of card, mastercard to visa, or vice versa. This will only protect you for one move ,because if you have to do this again. Merchants that you thought were forgotten even years later will find you and post a charge legally. Virtual numbers from Mastercard or Visa won't stop them.   I believe this is the number one reason for credit card fraud for consumers. There is no reason for a merchant to let anyone off the hook when the credit card company will side with them.  The article below does state that Mastercard does have a ""stop recurring payment"" flag.  Apparently no CSR tht I have talked to knows about it when I have asked to get a problem fixed. I have found that the only way to stop these charges from happening is to close all my visa and mastercard credit cards, pay with a check that you write and mail or a PayPal one time payment that is sent to pay for an invoice.   Recurring Credit-Card Charges May Irk Consumers"
There are different ways of credit card purchase authorizations. if some choose less secure method it's their problem. Merchants are charged back if a stolen card is used. "In 2010, the Restore Online Shoppers' Confidence Act was passed, which prohibited certain activities, most of which had to do with online sites sharing your CC info with third parties.  However, the final part of the act deals with ""negative option"" marketing, which is basically what you're describing - ""We will charge you unless you say no"". It requires three components to allow a negative option: If you did not explicitly enroll in automatic payment, and made the initial purchase online (or made your most recent purchase online, I suspect) then it sounds like this was a violation of this act.  On the other hand, the act isn't terribly careful about defining terms, and is really quite vague in a lot of places, so it's possible they would argue they are not using a 'negative option' scheme but instead simply charging your bill similar to how your phone company might use autopay. If it was not online, then this probably doesn't apply.  Instead, the FTC's rule on Negative Option with regard to sale of goods applies.  Title 16 Part 425 covers this; this law is much less limiting as to what the marketer can do." "I think your confusion comes from the negative impact when a creditor writes off your bad credit and ceases attempting to collect it. ""Chargebacks"" as you call them are an attempt to undo fraudulent charges on your card, whether from stolen credit card info or from a merchant who is using shady business practices. For what it's worth, if you joined on December 20, January 20 seems like a reasonable date for the next billing cycle, with the December 31 date reflecting the fact that their system couldn't automatically bill you the day you joined. I also think it's reasonable for you to ask them to refund the bill for the second month if you do not plan to use their gym further. So the dispute seems like a reasonable one on both sides. Good luck." "File a John Doe lawsuit, ""plaintiff to be determined"", and then subpoena the relevant information from Mastercard.  John Doe doesn't countersue, so you're pretty safe doing this.  But it probably won't work.  Mastercard would quash your subpoena.  They will claim that you lack standing to sue anyone because you did not take a loss (which is a fair point).    They are after the people doing the hacking, and the security gaps which make the hacking possible.  And how those gaps arise among businesses just trying to do their best.  It's a hard problem.  And I've done the abuse wars professionally.  OpSec is a big deal.  You simply cannot reveal your methods or even much of your findings, because that will expose too much of your detection method.  The ugly fact is, the bad guys are not that far from winning, and catching them depends on them unwisely using the same known techniques over and over.  When you get a truly novel technique, it costs a fortune in engineering time to unravel what they did and build defenses against it.  If maybe 1% of attacks are this, it is manageable, but if it were 10%, you simply cannot staff an enforcement arm big enough - the trained staff don't exist to hire (unless you steal them from Visa, Amex, etc.)  So as much as you'd like to tell the public, believe me, I'd like to get some credit for what I've done -- they just can't say much or they educate the bad guys, and then have a much tougher problem later.  Sorry!  I know how frustrating it is! The credit card companies hammered out PCI-DSS (Payment Card Industry Data Security Standards).  This is a basic set of security rules and practices which should make hacking unlikely.  Compliance is achievable (not easy), and if you do it, you're off the hook.  That is one way Amy can be entirely not at fault.  Example deleted for length, but as a small business, you just can't be a PCI security expert.  You rely on the commitments of others to do a good job, like your bank and merchant account salesman.  There are so many ways this can go wrong that just aren't your fault.   As to the notion of saying ""it affected Amy's customers but it was Doofus the contractor's fault"", that doesn't work, the Internet lynch mob won't hear the details and will kill Amy's business. Then she's suing Mastercard for false light, a type of defamtion there the facts are true but are framed falsely.   And defamation has much more serious consequences in Europe.  Anyway, even a business not at fault has to pay for a PCI-DSS audit.  A business at fault has lots more problems, at the very least paying $50-90 per customer to replace their cards.  The simple fact is 80% of businesses in this situation go bankrupt at this point.   Usually fraudsters make automated attacks using scripts they got from others.  Only a few dozen attacks (on sites) succeed, and then they use other scripts to intercept payment data, which is all they want. They are cookie cutter scripts, and aren't customized for each site, and can't go after whatever personal data is particular to that site. So in most cases all they get is payment data. It's also likely that primary data, like a cloud drive, photo collection or medical records, are kept in completely separate systems with separate security, unlikely to hack both at once even if the hacker is willing to put lots and lots of engineering effort into it.  Most hackers are script kiddies, able to run scripts others provided but unable to hack on their own.   So it's likely that ""none was leaked"" is the reason they didn't give notification of private information leakage.  Lastly, they can't get what you didn't upload.  Site hacking is a well known phenomenon.  A person who is concerned with privacy is cautious to not put things online that are too risky.  It's also possible that this is blind guesswork on the part of Visa/MC, and they haven't positively identified any particular merchant, but are replacing your cards out of an abundance of caution." "Abine has a product for iOS and Android (and desktop), now called called Blur, that provides credit card masking (alias credit card numbers), along with other privacy services. It's subscription-based. I've used it successfully for a number of transactions over the past year or so. To the merchant, you supply any name, Abine's address, and the specific masked credit card number and code. You can create any number of masked cards with different credit amounts, and the charges show up on your real card statement as ""Abine, Inc.""." There are a couple of things to consider.   First, in order to avoid interest charges you generally just need to pay the statement balance before the statement due date.  This is your grace period.  You don't need to monitor your activity every day and send immediate payments.  If you're being really tight with money, you can actually make a little profit by letting your cash sit in an interest bearing account before you pay your credit card before the due date. Second, credit card interest rates are pretty terrible, and prescribed minimum payments are comically low.  If you buy furniture using your credit card you will pay some interest, be sure to pay way more than the minimum payment.  You should avoid carrying a balance on a credit card.  At 20% interest the approximate monthly interest charge on $1,000 is $16.67. Third, if you carry a balance on your credit card you lose the interest grace period (the first point above) on new charges.  If you buy your couch, and carry the balance, when you buy a soda at 7-11, the soda begins to accrue interest immediately.  If you decide to carry a balance on a credit card, stop using that card for new charges.  It generally takes two consecutive billing period full balance payments to restore the grace period. Fourth, to answer your question, using a credit card to carry a balance has no impact on your score.  Make your payments on time, don't exceed your limits, keep your utilization reasonable.  The credit agencies have no idea if you're carrying a balance or how much interest you're paying. To Appease the people who think point four needs more words: Your credit report contains your limit, your reported balance (generally your statement balance), and approximate minimum payment.  There is no indication related to whether or not the balance contains a carried balance and/or accrued interest.  The mere fact of carrying a balance will not impact your credit score because the credit reporting bureaus don't know you're carrying a balance.  Paying interest doesn't help or hurt your score.  Obviously if your carried balance and interest charges push your utilization up that will impact your score because of the increased utilization. Make your payments on time, don't exceed your limits, keep your utilization reasonable and your score will be fine. If the card has no annual fee, you can keep it for as long as you like and you will never get charged. I advise you to GoPaperless so you stop getting the $0 bills every month. Many cards have the fee waived for the first year. If you have such a card, you should make sure to cancel it when you stop using it, or when the fee waiver expires. I did just what you suggest. The card company honored the charge, they told me the temporary number was solely for the purpose of assigning a number to one vendor/business. So even though I set a low limit, the number was still active and the card company paid the request. Small price to pay, but it didn't go as I wished.    For this purpose, I've used Visa/Mastercard gift cards. They are often on sale for face value and no additional fees. Short of canceling the card, you could just report the card as lost and ask for a new card number on the same account. Another option is to just make a note to look for the charge and keep disputing it. It has been a while since I did credit card processing at my business, but I think the company gets dinged if too many customers dispute charges and kicks them into a higher fee schedule with the credit card company. Almost every company I know of charges something like 2% per month on past due accounts.  They are not financial institutions, so it's probably quite legal. "You have no recourse on the spot to do anything to the vendor other than pay the fee, pay cash, or walk away.  If you're on a mission with longer-term horizon than immediate satisfaction, your options will vary by state.  If you're in a state where the fees are legal and the owner is (potentially) violating an agreement with the card company, you can report the vendor to the card company.  They may or may not really care.  If you're in a state where the fee is actually illegal, you'd need to see what options you have with the local authorities. You should keep in mind that if the vendor is violating an agreement that's between the vendor and the card company only, you have absolutely no rights to enforce that agreement.  You only have legal rights if you're a party to the agreement in question or if the law gives you some special rights specific to given circumstances. (The lawyers call this having ""standing."")  Likewise if the vendor is doing something that's not consistent with the agreement between you and the card company, you also have no claim against the vendor (because the vendor is not party to your agreement with the card company), although you might have a claim against the card company." "If I understand you correctly, no you shouldn't be charged interest. Lets say you have a billing cycle of monthly (which usually isn't true). You charge $XX per day, ending up at $1000 at the end of January. So February 1st, your bill for your January billing cycle is $1000, due by Feb 15th (lets say). On February 1st, you continue to charge $XX per day. You go to pay your bill online on Feb 14th (to be safe), and you'll usually see on your credit card website something like: You'd hit ""Pay my bill"", and you'd usually see these options: At the date your cycle was due (Feb 15th), if you haven't paid your full latest statement (lets say you paid $500), they will charge you interest on the entire balance for the period (so interest on $1000, or lets say $50). The other $500 will roll over to the next month, so your next month you'd be somewhere near a $1550 bill." "You should dispute the transaction with the credit card. Describe the story and attach the cash payment receipt, and dispute it as a duplicate charge. There will be no impact on your score, but if you don't have the cash receipt or any other proof of the alternative payment - it's your word against the merchant, and he has proof that you actually used your card there. So worst case - you just paid twice. If you dispute the charge and it is accepted - the merchant will pay a penalty. If it is not accepted - you may pay the penalty (on top of the original charge, depending on your credit card issuer - some charge for ""frivolous"" charge backs). It will take several more years for either the European merchants to learn how to deal with the US half-baked chip cards, or the American banks to start issue proper chip-and-PIN card as everywhere else. Either way, until then - if the merchant doesn't know how to handle signatures with the American credit cards - just don't use them. Pay cash. Given the controversy in the comments - my intention was not to say ""no, don't talk to the merchant"". From the description of the situation it didn't strike me as the merchant would even bother to consider the situation. A less than honest merchant knows that you have no leverage, and since you're a tourist and will probably not be returning there anyway - what's the worst you can do to them? A bad yelp review? You can definitely get in touch with the merchant and ask for a refund, but I would not expect much to come out from that." "I put bills with a fixed monthly amount to my credit card, and remember to pay it every month.  However, I do not let any bill with a variable amount ""pull"" access to my funds.  I have to ""push"" the payment.  The reason is simple: We've all heard the tale of the Electric meter that rolled past zero, and the customer got charged for $65000.00, or other similar situations.  When there is pull access to my money, then I have to work to get my money back.  When there is push access, I can (in the electric situation above) pay an estimated monthly amount, (say $100) to demonstrate good faith and make them come after me.  When they do, I can ask them to demonstrate the accuracy of the bill.  If I have to go after them, I have to demonstrate the inaccuracy." "Typically, the CC company itself won't follow the customer very far upon a default (though it certainly can act as its own debt collector, or hire an agency for a fee to do the collection).  What most often happens: Once they do that, assuming they win the lawsuit, they can do the following: They cannot ""force"" you into bankruptcy, but they might make it so you have no better options (if bankruptcy is less painful than the above, which it often is).  They certainly can (and will) report to the credit bureaus, of course.  For more information, Nolo has a decent help site on this subject. Different jurisdictions have slightly different rules, so look up yours.  Here is an example (this is from Massachusetts). Not every debt is sued for, of course; particularly, pay attention to the statute of limitations in your state.  (In mine, it's seven years, for example.)  And it's probably worth contacting someone locally (a legitimate non-profit debt relief agency, or your state's help agency if they have one) to find local rules and regulations."