How should I collect card numbers securely?

Use PCI‑validated hosted payment fields or pass the card directly to your processor for tokenization. Avoid collecting PANs in unsecured forms or email to reduce breach risk and comply with payment standards.

Can an electronic Card Update Request be legally binding?

Yes. Electronic authorization can be binding under the ESIGN Act and UETA when intent, consent, attribution, and retrievability are documented. Consumer disclosures may be required for consumer‑facing transactions.

Is notarization required for card updates?

Not typically. Notarization is uncommon for routine payment method changes; only use notaries when your internal policy or a counterparty contract expressly requires it.

What if the cardholder disputes a charge after an update?

Retain the signed authorization, audit trail, and tokenization records to support dispute resolution. Promptly investigate and follow processor dispute procedures to minimize liability.

Can I store CVV for future use?

No. PCI DSS prohibits storage of card verification codes after authorization. Store tokens and other allowed data while ensuring strict access controls.

Which authentication methods are recommended?

At minimum use account login verification; add OTP (SMS or email) or an identity check for higher‑risk updates. Record the method and evidence as part of the audit trail.

Card Update Request

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Card Update Request

This Card Update Request and Card Update Agreement (the Agreement) is entered into as of between Client Name: and Company Name: .

WHEREAS

WHEREAS, Client Name: maintains an account with Company Name: for services and recurring charges; and

WHEREAS, Client requires an update to the payment card information on file and both parties desire to document the scope, authorization, and terms under which the update and any resulting charges will be processed.

NOW, THEREFORE, in consideration of the mutual covenants set forth herein, the parties agree as follows.

Scope of Work

Description of Update and Services

Cardholder Information

Cardholder / Account Name Client Account Number / Customer ID Contact Email Contact Phone Billing Address

Card Details

Cardholder Name (as printed on card)

Card Type: Visa MasterCard American Express Discover

Last Four Digits of Card

Expiration: Month Year

Update Requested

Replace existing card on file with new card
Update expiry date only
Update billing address
Other (describe)

If Other, describe

Payment Terms

Amount authorized to be charged for outstanding balance or immediate updates: $ .

Payment schedule: One-time charge Recurring charges per existing agreement Next scheduled charge date:

Late fee for failed payment or returned payment: . Client acknowledges that Company may attempt reauthorization up to two additional times before terminating services in accordance with this Agreement.

Authorization

Client hereby expressly authorizes Company and its payment processor to update the card information on file and to charge the updated card for amounts authorized above and for any future amounts permitted under the parties' underlying service agreement. Client certifies that the card information provided is accurate, that Client is authorized to use the card, and that Client will notify Company promptly of any changes to card status or authorization.

Term and Termination

Term: This Agreement shall commence on Start Date: and remain in effect until End Date: unless earlier terminated as provided herein.

Either party may terminate this Agreement for convenience by providing written notice to the other party at least days prior to termination. Termination for material breach shall be effective upon written notice if the breaching party fails to cure within 10 days of receipt of notice.

Confidentiality

Each party agrees to maintain in confidence all non-public business and technical information disclosed in connection with this Agreement, including but not limited to card data, billing records, and account identifiers (Confidential Information). Confidential Information shall not include information that is or becomes generally available to the public other than through a breach of this provision. The receiving party will use at least the same degree of care to protect Confidential Information as it uses to protect its own confidential information, but in no event less than reasonable care. The obligations under this clause survive termination of this Agreement for a period of two (2) years, except that obligations with respect to payment card data remain in place as required by applicable payment industry standards.

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to conflict of laws principles. Venue for any dispute arising under this Agreement shall be exclusively in the courts located in that state.

Entire Agreement

This Agreement, together with any incorporated statements of work or billing authorizations referenced herein, constitutes the entire agreement between the parties related to the subject matter and supersedes all prior and contemporaneous agreements, representations, and understandings, whether written or oral. Any amendment to this Agreement must be in writing and signed by authorized representatives of both parties.

Certifications and Representations

By signing below, Client certifies that the information provided in this Card Update Request is true and correct, that Client is the authorized cardholder or has obtained authorization from the cardholder, and that Client will notify Company immediately of any revocation of authorization or change in card status. Client further agrees to indemnify Company for any losses resulting from inaccurate or fraudulent card information provided by Client.

Client Name:

By:

Date:

Company Name:

By:

Date:

What a Card Update Request Is and When It Applies

A Card Update Request is a written or electronic form used to change payment card information on file with a merchant, service provider, or billing system. It captures new cardholder details (name, card number, expiration date, CVV), billing address, and signer authorization so recurring billing and one-time charges continue without interruption. Organizations often use secure online forms with tokenization and audit trails to minimize exposure of card data and to document consumer consent for electronic billing and record retention.

Why a Card Update Request Matters

Keeping card details current prevents failed payments, service interruptions, and collection costs while creating an auditable record of customer consent. Properly completed requests reduce disputes and support compliance with electronic record laws and payment security standards.

Who Handles Card Update Requests

Organizations and individuals involved in billing, collections, and subscription management rely on Card Update Requests to keep payment data accurate.

Billing and accounts receivable teams that maintain recurring payment records and reconcile failed transactions.
Customer support and subscription operations that collect updated card details during service changes or renewals.
Customers using self-service portals to update card information for ongoing subscriptions or one-time charges.

Use the form only with secure collection methods and documented customer authorization to reduce fraud and regulatory risk.

Step-by-Step: Completing the Card Update Request

Follow this simple sequence to collect and process updated card details securely and consistently.

01

Collect Details: Ask the cardholder for required fields and confirm billing address.
02

Authenticate Signer: Use account verification, SMS code, or other accepted method to confirm identity.
03

Tokenize Card: Submit card data to a PCI‑compliant processor and store only tokens, not PANs.
04

Record Consent: Capture authorization timestamp, IP address, and a copy of the signed request.

Where Updated Card Details Go After Submission

After the request is completed, routes and processing steps determine how data is stored and who is notified.

Billing System: Update the customer record and next invoice with the tokenized payment method.
Payment Processor: Transmit data to the processor or gateway for tokenization and future authorizations.
Secure Vault: Store tokens and audit logs in a PCI‑compliant vault or key management system.
Notification: Send confirmation to the cardholder and internal teams that the update succeeded.

Recommended Online Workflow Settings

Configure the form workflow to minimize friction, enforce authentication, and ensure compliance with payment rules.

Field	Configuration
Card Input	Use PCI‑validated hosted fields or tokenization; block copy/paste where required.
Authentication	Require account verification and optional SMS or email OTP for high-value changes.
Storage	Store payment tokens only; avoid storing PANs or CVV in persistent records.
Audit Trail	Record IP, timestamp, signer identity, and versioned request PDFs.

Technical Requirements and Integration Options

Use secure browsers and integrations that support tokenization, encryption, and audit logging before accepting card updates.

Browser Support: Modern TLS‑capable browsers
File Formats: PDF, DOCX uploads supported
Integrations: CRM and payment gateway integrations

Verify the chosen platform supports PCI DSS or tokenization, integrates with your billing system, and provides an immutable audit trail.

Core Elements of a Professional Card Update Request

A complete request combines identity verification, clear authorization language, secure data handling, and recordkeeping to protect both payer and payee.

Cardholder Identification

Capture name and account identifier to link the update to the correct customer record; include secondary verification to prevent unauthorized changes.

Tokenization

Submit card data to an approved processor for tokenization so the merchant stores a token rather than the primary account number.

Authorization Language

Include explicit consent wording authorizing future charges and specifying the purpose, amount range, or recurring schedule when applicable.

Authentication Method

Require at least one method of signer authentication (account login, OTP, or knowledge‑based check) and record the method used.

Audit Trail

Retain a tamper‑evident record with timestamps, IP addresses, and a certificate of completion to support dispute resolution.

Privacy & Compliance

Apply data minimization, encrypt data in transit and at rest, and follow PCI and applicable privacy laws for storage and access controls.

Security and Compliance Checklist

Encryption: TLS 1.2/1.3, AES‑256

PCI: PCI DSS compliance required

Audit Trail: Immutable logs and timestamps

HIPAA: BAA for protected health data

Access Controls: Role‑based permissions

Data Minimization: Store tokens, not PANs

Common Errors to Avoid When Updating Card Information

Entering an expired card or incorrect expiry format prevents authorization and causes billing failures.
Mismatched billing address and AVS result in declined transactions and extra follow‑up with the customer.
Storing full PANs or CVV in unsecured fields increases breach risk and violates PCI storage rules.
Failing to obtain explicit authorization or a clear audit trail complicates chargebacks and dispute resolution.

Risks and Consequences of Improper Card Updates

Payment Failure: Late fees possible

Chargebacks: Dispute liability risk

Compliance: PCI violations fines

Data Breach: Notification obligations

Customer Loss: Service cancellations

Legal Exposure: Regulatory enforcement

Timing Considerations and Typical Deadlines

Plan submissions and internal processing so updates are applied before scheduled billing and to preserve consumer rights.

Next Billing Cycle Deadline:

Submit updates at least 3–5 business days before the billing date to avoid a failed charge.

Dispute Window:

Customers typically have 60 days to dispute unauthorized charges under federal consumer rules.

Authorization Retention:

Keep signed authorization and audit logs for the duration of the relationship and for tax or regulatory audits.

Processor Latency:

Allow 24–72 hours for tokenization and verification from payment gateways.

Internal SLA:

Set an internal processing SLA (for example, 2 business days) for applying updates to accounts.

Practical Examples of Card Update Requests in Use

Real organizations use structured update requests to reduce declined payments and maintain clear authorization records.

Martin Properties — Recurring Rent

Martin Properties digitized tenant card updates to minimize late rent notices and improve collections timing.

The change reduced manual follow‑up.
By routing updates through a secure portal and tokenizing cards, the property manager documented consent, reduced failed payments, and shortened resolution time for tenant billing issues.

Fertility Centers of Illinois — Patient Payments

Fertility Centers collected updated payment methods for a series of procedures with signed authorization.

Patient consent recorded electronically.
The clinic preserved HIPAA‑aligned audit logs, avoided storing CVV, and ensured billing staff could process scheduled charges without repeated outreach to patients.

Frequently Asked Questions About Card Update Requests

Answers to common questions about security, legality, and practical issues when collecting updated card information.

Need help? Contact support

How should I collect card numbers securely?
Use PCI‑validated hosted payment fields or pass the card directly to your processor for tokenization. Avoid collecting PANs in unsecured forms or email to reduce breach risk and comply with payment standards.
Can an electronic Card Update Request be legally binding?
Yes. Electronic authorization can be binding under the ESIGN Act and UETA when intent, consent, attribution, and retrievability are documented. Consumer disclosures may be required for consumer‑facing transactions.
Is notarization required for card updates?
Not typically. Notarization is uncommon for routine payment method changes; only use notaries when your internal policy or a counterparty contract expressly requires it.
What if the cardholder disputes a charge after an update?
Retain the signed authorization, audit trail, and tokenization records to support dispute resolution. Promptly investigate and follow processor dispute procedures to minimize liability.
Can I store CVV for future use?
No. PCI DSS prohibits storage of card verification codes after authorization. Store tokens and other allowed data while ensuring strict access controls.
Which authentication methods are recommended?
At minimum use account login verification; add OTP (SMS or email) or an identity check for higher‑risk updates. Record the method and evidence as part of the audit trail.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now