Credentials on File (COF)

Store Payment Credentials Independently of Your Payment Gateway

HostedPCI Credentials on File (COF) helps businesses securely store customer payment credentials and support recurring payments, returning customer purchases, and merchant-initiated transactions without requiring customers to re-enter their card information for every payment.

Unlike solutions that store payment credentials exclusively with a single payment gateway, HostedPCI maintains card information within its independent payment vault. This allows businesses to work with multiple supported payment providers, add backup gateways, or change processors without requiring customers to re-enter their stored card details.

HostedPCI combines payment tokenization, secure card storage, and stored credential transaction support to help businesses maintain greater control over their payment infrastructure.

As a PCI DSS Level 1 Service Provider, HostedPCI helps reduce unnecessary exposure to cardholder data while supporting flexible payment processing through compatible gateways.

What Is Credentials on File?

Credentials on File, also called COF, card-on-file, or stored credentials, refers to payment information that a business retains with the cardholder’s authorization for future transactions.

Card networks such as Visa and Mastercard have established stored credential frameworks that require merchants to identify transactions using previously stored payment information.

These frameworks distinguish between payments initiated by the customer and payments initiated by the merchant under an existing agreement.

Credentials on File supports business models such as subscription billing, recurring memberships, installment payments, returning customer purchases, and other eligible future charges.

HostedPCI supports these workflows by securely storing card information and applicable transaction references while providing the payment data and indicators required by supported payment gateways.

How Credentials on File Works

Credentials on File involves establishing a stored payment relationship and correctly identifying subsequent transactions.

Step 1: Customer Authorizes Stored Payment Credentials

The customer agrees to have their payment information stored for future use.

The merchant obtains the appropriate consent and communicates how the credentials will be used, including any recurring or future payment arrangements.

An initial customer-initiated transaction or account verification establishes the stored credential relationship according to the applicable card network and gateway requirements.

Step 2: HostedPCI Tokenizes and Stores Payment Information

HostedPCI stores the original card information within its secure payment vault and provides a token that the merchant can use to reference the stored credentials.

For supported integrations, HostedPCI also stores applicable network transaction references returned by the payment gateway.

The merchant can retain the token instead of storing the original card number within its own systems.

Step 3: Initiate a Subsequent Payment

When another payment is required, the merchant initiates the appropriate transaction using the stored payment credentials.

Depending on the transaction type, the customer may actively initiate a new purchase, or the merchant may submit a payment under an existing authorization.

HostedPCI supports retrieval of the stored payment information and applicable transaction references through compatible gateway integrations.

Step 4: Submit the Transaction for Authorization

The payment request is submitted to the configured gateway with the appropriate stored credential indicators and transaction references.

The gateway forwards the transaction for authorization, and the card issuer determines whether the payment is approved or declined.

Customer-Initiated vs. Merchant-Initiated Transactions

Understanding the difference between Customer-Initiated Transactions (CIT) and Merchant-Initiated Transactions (MIT) is essential for correctly implementing Credentials on File.

Customer-Initiated Transactions (CIT)

A Customer-Initiated Transaction occurs when the cardholder actively participates in the payment.

Examples include:

• A customer making an initial purchase and agreeing to save their card.
• A returning customer selecting a previously stored card during checkout.
• A customer actively authorizing an additional purchase.

The initial transaction or account verification may establish the stored credential relationship for future payments.

Merchant-Initiated Transactions (MIT)

A Merchant-Initiated Transaction occurs when a business initiates an eligible payment without the customer actively participating in that specific transaction.

These payments are based on a previously established agreement with the cardholder.

Examples include:

• Monthly subscription payments
• Recurring membership fees
• Scheduled installment payments
• Eligible unscheduled charges under an existing agreement
• Certain delayed charges or additional authorizations

Subsequent merchant-initiated transactions may require references to the original transaction and specific indicators identifying the payment type.

Requirements vary by card network, payment gateway, and transaction category.

How HostedPCI Supports Credentials on File

Secure Card Storage and Tokenization

HostedPCI stores payment card information within its PCI DSS Level 1 Service Provider infrastructure.

Merchants receive HostedPCI tokens that can be used to reference stored cards without retaining original card numbers in their own systems.

Gateway-Independent Card Storage

HostedPCI stores payment credentials in its independent payment vault rather than exclusively with a single payment gateway.

This allows businesses to use stored cards across supported payment providers, add backup gateways, or change processors without asking customers to re-enter their card information.

Stored credential transaction references and gateway-specific requirements may need to be reviewed when moving between payment providers.

Network Transaction Reference Storage

For supported Credentials on File integrations, HostedPCI stores applicable network transaction references returned by the payment gateway alongside the associated payment credentials.

These references, sometimes identified as an Issuer ID within HostedPCI’s integration, help link subsequent merchant-initiated payments to the original stored credential transaction.

When required by the supported gateway, HostedPCI includes the applicable stored reference and transaction indicators in subsequent authorization requests.

Account Updater Integration

HostedPCI supports Account Updater integrations with providers including Chase and CyberSource, helping businesses keep stored payment credentials current when eligible cards are renewed or replaced.

Depending on the provider and card network, updates may include revised expiration dates or replacement card numbers.

This can help reduce recurring payment failures caused by outdated card information.

Account Updater availability and supported functionality depend on the selected provider and integration configuration.

Multi-Gateway Payment Integration

HostedPCI integrates with multiple payment gateways, allowing businesses to support stored credential workflows through compatible providers.

Rather than maintaining separate card vaults for every gateway, businesses can use HostedPCI tokens as a consistent reference for their stored payment information.

Supported transaction types, issuer references, and processing requirements vary by gateway.

Integration With 3D Secure 2

Credentials on File can work alongside 3D Secure 2 authentication, depending on the transaction and payment provider.

For transactions subject to Strong Customer Authentication requirements, such as certain initial stored credential transactions in the European Economic Area and United Kingdom, 3D Secure 2 can help support the applicable authentication requirements.

Subsequent eligible merchant-initiated transactions may be treated differently under the relevant authentication rules.

PCI DSS Scope Reduction

By using HostedPCI tokenization and payment vaulting, businesses can reduce how much of their environment directly handles cardholder information.

This can help reduce PCI DSS scope depending on the integration and overall payment environment.

Credentials on File does not eliminate a merchant’s remaining PCI DSS responsibilities.

Benefits of Credentials on File for Businesses

Greater Payment Gateway Flexibility

Keep payment credentials independently of a single gateway, allowing your business to introduce additional payment providers or change processors without requiring customers to resubmit their stored card information.

Simplify Recurring Payment Processing

Support eligible subscription and recurring payments using stored credentials without requiring customers to enter their card information for each billing cycle.

Improve the Returning Customer Experience

Allow returning customers to make payments using previously stored cards through supported integrations, reducing repetitive payment entry.

Support Better Authorization Decisions

Correctly identifying stored credential transactions helps issuers understand the relationship between the cardholder, merchant, and payment request.

This may improve authorization outcomes and reduce avoidable declines, although approval rates are not guaranteed.

Reduce Payment Failures From Outdated Cards

Through supported Account Updater integrations, businesses may be able to maintain current card information when eligible payment cards expire or are replaced.

This can help reduce unsuccessful recurring transactions caused by outdated card details.

Who Can Benefit From Credentials on File?

Subscription and Membership Businesses

SaaS providers, subscription services, membership organizations, and associations can use stored payment credentials to support recurring billing and membership renewals.

E-commerce Businesses

Online retailers can offer returning customers a more convenient checkout experience using previously stored cards.

Enterprise Payment Platforms

Organizations operating across multiple payment gateways can maintain centralized payment credentials while supporting stored-card transactions through compatible providers.

Travel, Hospitality, and Service Providers

Businesses requiring eligible delayed charges, installment payments, or other future transactions can use Credentials on File to support their payment workflows, subject to applicable card network and gateway requirements.

Use Case: Recurring Subscription Payments Across Multiple Gateways

A SaaS company offers customers monthly subscription services and wants to maintain the flexibility to use different payment providers as its business grows.

Customers provide their credit card information when they subscribe and authorize the company to charge their cards for future monthly payments.

Instead of storing customer payment credentials with a single gateway, the company uses HostedPCI’s independent payment vault.

With HostedPCI Credentials on File:

1. Customer Authorization: The customer agrees to the recurring billing arrangement and provides payment details through a supported HostedPCI integration.
2. Initial Transaction: The first payment or account verification establishes the stored credential relationship using the appropriate gateway and card network indicators.
3. Tokenization: HostedPCI stores the card details and applicable transaction reference. The SaaS platform retains a HostedPCI token.
4. Recurring Payments: When the next billing cycle begins, the SaaS platform initiates an eligible merchant-initiated transaction using the stored token.
5. Payment Authorization: HostedPCI supplies the applicable payment data and stored credential information through the configured gateway integration.
6. Gateway Flexibility: If the company later introduces another supported gateway, the stored card information remains available within HostedPCI’s vault. Gateway-specific transaction references and requirements are reviewed as part of the change.

This allows the SaaS platform to manage recurring billing while maintaining greater independence from individual payment providers.

Need to support recurring payments without locking your stored cards to one gateway?

Contact HostedPCI to discuss your Credentials on File requirements and supported payment gateway integrations.

Credentials on File FAQs

What is Credentials on File (COF)?

Credentials on File, also called card-on-file or stored credentials, is a payment framework for retaining customer payment information with their authorization for future use.

It includes requirements for identifying customer-initiated and merchant-initiated transactions, obtaining appropriate consent, and providing the applicable transaction information to payment providers.

What is the difference between CIT and MIT?

A Customer-Initiated Transaction (CIT) occurs when the cardholder actively participates in the payment.

A Merchant-Initiated Transaction (MIT) occurs when the business initiates an eligible payment under an existing agreement without the cardholder’s active participation in that specific transaction.

Both transaction types may involve previously stored payment credentials.

Does HostedPCI store the customer’s original card information?

Yes. HostedPCI stores payment card information within its payment vault and provides tokens that businesses can use to reference the stored credentials.

For supported Credentials on File integrations, applicable transaction references can also be stored alongside the card information.

Can businesses use stored cards with multiple payment gateways?

Yes. Because HostedPCI stores card information independently of a single gateway, businesses can use stored credentials across supported payment integrations.

This allows organizations to add or change payment providers without asking customers to re-enter their card details.

Stored credential transaction references and gateway-specific requirements may need to be reviewed when moving between payment providers.

Does HostedPCI offer Account Updater services?

Yes. HostedPCI supports Account Updater integrations with providers including Chase and CyberSource.

These services help businesses update eligible stored card information when card numbers or expiration dates change.

Availability and supported update functionality depend on the Account Updater provider and integration.

What is an Issuer ID or network transaction ID?

A network transaction ID is a reference associated with the original stored credential transaction. Subsequent eligible merchant-initiated transactions may use this reference to link the payment to the original transaction and stored credential arrangement.

Depending on the card network and gateway, this may be called a Transaction ID, Trace ID, or Network Transaction Reference.

HostedPCI uses the Issuer ID parameter in supported Credentials on File integrations to store and transmit the applicable reference for subsequent transactions.

Is CVV required for Credentials on File transactions?

CVV requirements depend on the transaction type, gateway, and card network rules.

An initial customer-initiated transaction may require CVV, depending on the payment flow. However, CVV is generally not required for eligible subsequent merchant-initiated transactions.

PCI DSS prohibits storing CVV after authorization, even if encrypted.

Can Credentials on File be used for recurring payments?

Yes. Credentials on File supports eligible recurring payment arrangements, including subscriptions, membership fees, and scheduled payments.

The merchant must establish the appropriate customer agreement and use the required transaction indicators.

Can customers use a previously stored card for another purchase?

Yes. When a returning customer actively makes a purchase using a saved card, the payment is generally classified as a customer-initiated transaction using stored credentials.

The appropriate transaction indicators and authentication requirements still apply.

Does HostedPCI automatically charge customers for recurring payments?

No. HostedPCI provides payment credential storage, tokenization, and supported payment gateway integrations.

The merchant’s billing application determines when recurring payments are initiated.

HostedPCI supports the submission of eligible stored credential transactions through compatible gateways.

Which payment gateways support Credentials on File?

HostedPCI supports Credentials on File functionality through selected payment gateway integrations, including Fiserv (First Data IPG and Payeezy), Chase Paymentech Orbital, CyberSource, and Global Payments (Realex).

Available transaction types, required parameters, and stored credential reference handling vary by gateway.

Contact HostedPCI to confirm the supported Credentials on File functionality for your payment provider.

Does Credentials on File guarantee higher approval rates?

No. Correctly identifying stored credential transactions may help issuers make more informed authorization decisions, but approval rates depend on the issuer, payment provider, transaction details, and other factors.

Does Credentials on File reduce chargebacks?

Credentials on File helps identify the established customer-merchant payment relationship, but it does not prevent all disputes or chargebacks.

Merchants remain responsible for obtaining appropriate consent, clearly communicating billing terms, and meeting applicable payment requirements.

Can Credentials on File work with 3D Secure 2?

Yes. HostedPCI supports Credentials on File and 3D Secure 2 through compatible configurations.

3D Secure 2 may be used to authenticate the initial customer transaction, while eligible subsequent merchant-initiated payments follow the relevant stored credential and authentication requirements.

Does Credentials on File eliminate PCI DSS requirements?

No. Credentials on File does not eliminate PCI DSS obligations.

HostedPCI’s tokenization and payment vaulting services can help reduce PCI DSS scope depending on the merchant’s implementation and overall payment environment.

Support Secure Stored Card and Recurring Payments With HostedPCI

HostedPCI Credentials on File helps businesses store payment credentials independently of individual payment gateways, support recurring and future transactions, and maintain flexibility across supported payment providers.

Whether you’re managing subscriptions, membership payments, returning customers, or multi-gateway payment operations, HostedPCI provides the tokenization and payment infrastructure needed to support your stored credential workflows.

Contact HostedPCI to discuss your Credentials on File integration requirements.

Explore HostedPCI Credentials on File API Documentation for technical implementation details.

Additional Resource:

• Blog: Purpose of Credentials on File Mandate