A payment vault is encrypted storage that holds your card or bank account information so you don't have to enter it every time you pay
When you save a card to a website or app, that information goes into a payment vault — a secure database that encrypts and stores your payment details. Instead of typing your card number, expiration date, and CVV each time you make a purchase, you select the saved card from a list. The merchant or payment processor retrieves the encrypted data from the vault, processes the transaction, and never stores the full card number on their own servers.
Payment vaults exist in two main forms. A merchant-hosted vault is run by the company you're buying from — Amazon, Netflix, or your utility company. A processor-hosted vault is run by the payment processor itself, like Stripe or Square, and the merchant only stores a reference token that points to your real card data. Processor-hosted vaults are generally more secure because the merchant never touches your actual card number.
The vault doesn't process the payment itself. It only stores and retrieves the data. When you click "pay with saved card," the vault sends the encrypted information to a payment processor, which charges your card and confirms the transaction. If the processor approves it, the charge goes through. If it declines, you get a decline message and can try a different card from the vault or enter new payment details.
Key Takeaways
- A payment vault encrypts and stores your card or bank account details so you can pay without re-entering them each time.
- Merchant-hosted vaults are run by the company you buy from; processor-hosted vaults are run by the payment processor and are generally more secure.
- The vault stores your data but does not process payments — it only retrieves the encrypted information when you authorize a charge.
- You can delete a saved card from a vault at any time, and most vaults let you set a default payment method for faster checkout.
- If your card is compromised, you can remove it from the vault immediately without affecting other saved cards or accounts.
How a payment vault protects your card number
A vault uses encryption to scramble your card data into a code that only the vault system can read. Your full card number is never displayed on the merchant's website or stored on their servers. Instead, the merchant stores only a token — a unique reference string that points to your real card data in the vault. If a hacker breaks into the merchant's database, they get the token, not your card number.
When you authorize a payment, the vault decrypts your card data just long enough to send it to the payment processor. The processor verifies the card is real and has sufficient funds, then re-encrypts the data and returns a confirmation. Your card number is never exposed during this exchange. If the processor is breached, your card data is encrypted and useless without the decryption key, which the vault keeps separate.
This setup reduces your fraud risk compared to entering your card manually each time. You're not typing your number into different websites, each with different security standards. Instead, your card data sits in one encrypted location, and only authorized transactions can retrieve it.
Merchant vaults versus processor vaults
A merchant-hosted vault is managed by the company you're paying. Your utility company, insurance provider, or favorite online retailer runs the vault on their own servers. They encrypt your card data and store it locally. This is convenient for the merchant because they control the entire payment flow and can offer one-click checkout. But it also means they are responsible for keeping your card data secure. If their security is weak, your card is at higher risk.
A processor-hosted vault is managed by a third-party payment processor like Stripe, Square, or PayPal. The merchant never stores your actual card number — only a token that references it. When you pay, the merchant sends the token to the processor, which retrieves your real card data from the vault and processes the charge. This is more secure because the merchant's database doesn't contain your card number. Even if the merchant is hacked, the attacker cannot access your payment details.
Most large merchants and subscription services use processor-hosted vaults because payment processors invest heavily in security and compliance. Smaller merchants may use merchant-hosted vaults because they're cheaper to set up. When you save a card to a website, you can usually find out which type of vault they use by checking their privacy policy or payment security page.
What happens when you save a card to a vault
When you enter your card details on a website or app and check a box to save the card, the following happens: Your card number, expiration date, and CVV are sent over an encrypted connection (HTTPS) to the vault. The vault encrypts the data again using its own encryption key and stores it in a database. The merchant or processor generates a unique token and associates it with your card. That token is what the merchant stores and uses to identify your saved card in the future.
You can usually see your saved cards in your account settings. Most vaults display only the last four digits of your card and the card type (Visa, Mastercard, etc.), so you can identify which card is which without exposing the full number. You can set one card as your default payment method, which will be charged automatically unless you select a different card at checkout.
If you want to remove a card from the vault, you can delete it from your account settings. The token is destroyed, and the vault no longer associates that card with your account. The card itself remains active — you can still use it elsewhere — but that merchant or processor can no longer charge it without your permission.
When a vault charge fails or is declined
If a charge from a saved card fails, the vault does not automatically retry it. The payment processor sends a decline message back to the merchant, which notifies you. Common reasons for decline include insufficient funds, an expired card, a card reported as lost or stolen, or a mismatch between your billing address and the one on file with your bank.
When a charge fails, you have options. You can update the card in the vault if the expiration date has changed. You can add a new card to the vault and select it as your default. Or you can contact your bank to find out why the charge was declined and ask them to approve future charges from that merchant. Many subscription services will pause your service temporarily and send you an email asking you to update your payment method.
Some vaults offer dunning — automatic retry logic that attempts to charge your card again after a decline, usually a few days later. This is common for subscription services. If the second attempt fails, the merchant typically suspends your account and asks you to update your payment method manually. You are not charged multiple times for a single failed transaction; the processor only charges you once per authorization.
Vault security and your responsibility
A vault is only as secure as the system that runs it. Processor-hosted vaults are generally more secure because payment processors are required to meet PCI DSS (Payment Card Industry Data Security Standard) compliance, which sets strict rules for how card data must be encrypted, stored, and accessed. Merchant-hosted vaults must also meet PCI DSS if they store card data, but enforcement varies and smaller merchants may not invest as heavily in security.
Your responsibility is to protect your account login. If someone gains access to your account, they can use your saved cards to make purchases. Use a strong, unique password for each merchant account. Enable two-factor authentication if the merchant offers it. Review your saved payment methods regularly and delete any cards you no longer use.
If your card is compromised or you suspect fraud, contact your bank or card issuer immediately. They can cancel the card and issue a replacement. You should then remove the old card from any vaults where you saved it and add the new card. Most card issuers offer fraud protection, so unauthorized charges are usually reversed within 30 days.
Vaults for recurring payments and subscriptions
Payment vaults are essential for subscription services and recurring billing. When you sign up for a monthly subscription, your card is stored in the vault. On the billing date each month, the merchant retrieves your card data from the vault and charges it automatically. You don't have to re-enter your card or authorize each charge separately.
This convenience comes with a responsibility: you must monitor your subscriptions and cancel them if you no longer want them. Many merchants make it easy to cancel through your account settings. Others require you to contact customer service. If you forget about a subscription and want to stop being charged, contact the merchant and ask them to remove your card from the vault and cancel the recurring billing.
If you want to change the card used for a recurring charge, you can usually update it in your account settings. The vault will use the new card for the next billing cycle. Some merchants allow you to pause a subscription temporarily without canceling it, which keeps your card in the vault but stops the charges.
Frequently Asked Questions
Is it safe to save my card to a website?
It is generally safe if the website uses a processor-hosted vault or meets PCI DSS compliance standards. Processor-hosted vaults are more secure because the merchant never stores your actual card number. Check the merchant's privacy or security page to see which type of vault they use. If you're unsure, you can always enter your card manually each time instead of saving it.
Can I use a saved card if my account is hacked?
If someone gains access to your account, they can use your saved cards to make purchases. This is why a strong, unique password and two-factor authentication are important. If you suspect your account is compromised, change your password immediately, remove your saved cards, and contact the merchant's support team. Your card issuer can also cancel the card and issue a replacement.
What happens to my saved card if I close my account?
When you close your account with a merchant, your saved cards are usually deleted from the vault. The merchant should send you a confirmation email. If you're concerned, you can manually delete your saved cards from your account settings before closing the account. The card itself remains active and can be used elsewhere.
Can I see my full card number in the vault?
No. Vaults display only the last four digits of your card and the card type for security reasons. This is intentional — it prevents someone looking over your shoulder from seeing your full card number. If you need to verify which card is saved, the last four digits and card type are usually enough to identify it.
What if my card expires while it's saved in a vault?
When your card expires, the vault still has the old expiration date on file. The next time a charge is attempted, the processor will decline it because the card is expired. You'll receive a notification asking you to update your payment method. You can edit the card in the vault to enter the new expiration date, or add a new card and set it as your default.