Account Updater: Visa VAU and Mastercard ABU

Account Updater is a batch service run by Visa and Mastercard that lets acquirers and merchants query for updated card credentials. You submit a list of stored card numbers and expiry dates; the network checks with the issuing banks and returns any changes.

The types of updates returned:

• New expiration date: The most common update. The card was reissued with a new expiry and CVV but the same PAN.
• New card number: The card was replaced entirely (e.g., after fraud). The PAN changed but the account remains active.
• Account closed: The issuer confirms no replacement card exists. You should stop billing and contact the customer.
• Contact cardholder: The issuer cannot provide updated details automatically. The cardholder needs to update their payment method manually.

Without Account Updater, you discover stale credentials only when a charge fails. With it, you update credentials proactively and avoid the decline entirely.

Visa's Account Updater operates on a batch cycle. The standard process:

1. Your acquirer submits a batch of stored Visa credentials to VisaNet, typically on a scheduled basis.
2. VisaNet checks each credential against the issuing bank's records.
3. Updated details are returned to the acquirer.
4. The acquirer forwards the updates to you (the merchant or platform).

Timing matters. VAU commonly checks cards expiring at month-end around the 15th of that month. Acquirers typically forward responses within two business days of receiving them from Visa. This means if a card expires on March 31, the update cycle runs around March 15, and you might receive the new details by March 17-19.

For cards replaced mid-cycle due to fraud or loss, the timing depends on when the replacement card is issued and when your next batch query runs. There can be a gap of days or weeks where your stored credentials are stale but Account Updater has not yet picked up the change.

Mastercard's ABU is functionally similar to Visa's VAU but has one significant difference: participation is mandatory for all consumer and business issuers. Every Mastercard issuer is required to respond to ABU queries, which gives ABU slightly better coverage than VAU in practice.

ABU supports both batch and real-time query modes, though batch remains the most common integration pattern. The batch process mirrors Visa's: submit credentials, receive updates, apply them to your stored payment methods.

Mastercard also supports a "real-time" ABU mode where the update query happens at the point of transaction decline. If a charge fails because the card details are stale, the acquirer can immediately query ABU for updated details and retry in a single flow. This reduces the window between decline and recovery to seconds rather than days.

Account Updater captures roughly 60-70% of card changes. The remaining 30-40% fall through for several reasons:

• Cardholder opt-out: In most markets, cardholders can opt out of Account Updater with their issuer. Once they opt out, the preference persists across card reissuances. Opt-out rates vary by market but typically run 5-10%.
• Non-participating issuers: While Mastercard ABU participation is mandatory, Visa VAU participation is not. Smaller issuers, credit unions, and issuers in certain countries may not participate.
• Account closed with no replacement: If the cardholder closed their account entirely (not just the card), there is no new card to provide. Account Updater returns a "closed" status, which is useful information but does not give you a new payment method.
• Batch timing gaps: If a card is replaced between batch cycles, there is a window where the old credentials are invalid but the update has not been delivered yet.
• Prepaid and gift cards: Most prepaid, gift, and single-use virtual cards are excluded from Account Updater entirely.

Even when Account Updater is working, several edge cases can trip you up:

Stale opt-out: A cardholder opts out of Account Updater, then their card is reissued. The opt-out persists on the new card. You will never receive automatic updates for this customer, even though they may not remember opting out years ago.

Token exclusion: This is the most commonly overlooked failure mode. Cards with active network tokens are excluded from Account Updater queries. The network assumes that if a token exists, the token lifecycle management system will handle updates. But if the token was not properly updated (or the token was provisioned by a different merchant), Account Updater will not serve as a fallback. You get a gap where neither system provides the update.

Cross-issuer migration: If a cardholder moves their account to a new bank entirely (not just a card replacement within the same bank), Account Updater typically cannot follow. The old issuer reports the account as closed; the new issuer has no link to the old credentials.

Partial updates: Some issuers return a new expiration date but not a new CVV. Since many processors require CVV for recurring transactions, the partial update may not be sufficient to prevent a decline.

Stripe runs Account Updater automatically for all stored payment methods. You do not need to opt in or configure anything. Stripe submits your stored card credentials to Visa VAU and Mastercard ABU on a regular batch cycle and applies updates when they come back.

Stripe fires a payment_method.automatically_updated webhook event when a card's details are updated through Account Updater. The event payload includes the updated card's last four digits, new expiration date, and the payment method ID.

For platforms using Stripe Connect with OAuth, this webhook is delivered through Connect webhooks, scoped to the connected account that owns the payment method.

You should listen for this event to:

• Log the update for audit purposes
• Update any card-on-file displays in your UI (e.g., "Visa ending in 4242, exp 12/27")
• Trigger a confirmation email to the customer if your UX includes card update notifications

Stripe also runs a pre-charge Account Updater check for some recurring payments, attempting to fetch updated credentials just before a scheduled charge. This reduces the window between card change and first failed payment.

Network tokens and Account Updater are complementary systems, not alternatives. Using both provides the highest coverage for card lifecycle changes.

Network tokens (Visa Token Service, Mastercard Digital Enablement Service) replace your stored PAN with a network-issued token. When the underlying card is replaced, the network updates the token-to-PAN mapping automatically. The merchant never needs to know the new PAN because the token stays the same.

Account Updater catches the cases that tokens miss: non-tokenized credentials, issuers that do not fully support token lifecycle updates, and cards where the token was provisioned by a different entity.

The gap between them: if you rely only on network tokens, you miss updates for non-tokenized cards and cards from issuers with incomplete token lifecycle support. If you rely only on Account Updater, you miss updates for tokenized cards (since AU excludes them) and you have batch timing delays.

The best practice is to tokenize all cards where possible (for real-time lifecycle updates) and maintain Account Updater as a fallback for everything else. Stripe does this automatically if you are using their payment method storage.

The numbers make the case clearly:

• Businesses using Account Updater see 3.8x higher approval rates on card-on-file transactions compared to those without it.
• Account Updater can reduce involuntary churn by 40-50% when combined with intelligent retry logic.
• 35% of customers forget to update their card details after receiving a replacement. Without Account Updater, these customers churn silently.

The 3.8x figure comes from comparing approval rates on transactions where Account Updater proactively updated credentials versus transactions where stale credentials were submitted and declined. It is not that Account Updater makes approvals 3.8x more likely in general; it is that proactively fixing stale credentials eliminates an entire category of preventable declines.

For subscription businesses, the math is straightforward. If 30% of your cards change annually and Account Updater catches 60-70% of those changes automatically, you are preventing 18-21% of your stored credentials from going stale. At a $100 average monthly subscription, that is $18-$21 per customer per year in revenue that would otherwise require manual intervention or be lost entirely.