145

I've made a single photo purchase from Shutterstock back in 2012. I created an account and gave them my debit card #. I haven't made a single purchase from them since.

Silently in 2018, they activated auto-renew without my consent, without notifying me via e-mail and without sending a receipt. They just started charging my new debit card. One that I hadn't even given them. This went on for 3 years without me noticing.

Then in July 2020 I lost my wallet, so I requested a new card. Somehow, Shutterstock had my updated debit card number and was able to withdraw from my checking account again in 2021, without me giving them my new debit card info.

I've never given them any of the newer card numbers since 2012. How is it possible for them to always have it? Is my banking information available somewhere for them to look up?

enter image description here

Improve this question
11
  • 9
    Crossdupe money.stackexchange.com/questions/98728/… (coincidentally from 2018)
    – dave_thompson_085
    Commented Jan 5, 2021 at 2:46
  • 47
    This is why it's important to regularly review all your recent credit activity. Seriously though, I don't say that to imply this is your fault. This auto update "feature" of credit cards causes more problems than it solves, and should die a fiery death. Companies that regularly charge cards without sending receipts should also did a fiery death. Unfortunately, these things do happen, which is why regularly checking account activity is a necessity these days.
    – Conor Mancone
    Commented Jan 5, 2021 at 13:08
  • 6
    @Harper-ReinstateMonica That doesn't explain how they got the new card number. A card isn't stored in a browser's cookies.
    – mbomb007
    Commented Jan 5, 2021 at 22:43
  • 5
    @Harper-ReinstateMonica I also wasn’t using the same computer between 2012 and 2018. Additionally, the auto-renew was activated on Jan 3rd, when I was on holiday vacation with my family. I don't think it's as much of a user error as you're implying.
    – M -
    Commented Jan 5, 2021 at 22:50
  • 7
    Beyond filing a fraud report, I'd also just contact Shutterstock and firmly request a cancelation of my account, and complete refund for the last four years. They should have data showing you haven't been using the account.
    – SafeFastExpressive
    Commented Jan 6, 2021 at 0:13

1 Answer 1

Reset to default
161

Simply put, Account Updater:

When participating issuers re-issue cards, they submit the new account number and expiration date to VAU. Participating merchants send inquiries on their credentials-on-file to VAU and are provided with updated card information, if available. This helps participating issuers retain cardholders by maintaining continuity of their payment relationships with participating merchants.

Shutterstock subscribes to Account Updater, and gets updated copies of your card info when it expires or is replaced.

VAU is Visa's version; more info is in a fact sheet here. MasterCard calls their version Account Billing Updater. American Express calls their version Cardrefresher. Payment processors will often aggregate multiple Card Brand's versions into a single service for Merchants.

It is theoretically possible to opt out of Account Updater, going through your bank to do so. It's one of those 'you have to know in order to ask' type of things, and I'm betting the ease of doing so varies from bank to bank.

Improve this answer
1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop ♦
    Commented Jan 7, 2021 at 13:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .