Which? finds cancelled card loophole can let fraud follow replacement cards

Which? reported on 24 June 2026 that automatic billing updater (ABU) services, which update saved card details when a card is replaced, can allow fraud to continue on a replacement card, and that most major high street banks do not offer customers an opt-out¹.

The feature is run by the three big card schemes and is switched on by default for banks, with many major online merchants opted in. American Express calls its scheme Cardrefresher, Mastercard calls it the Automatic Billing Updater (ABU) and Visa's scheme is the Visa Account Updater (VAU)¹. If a fraudster has saved a victim's card details to a merchant or digital wallet and the link is not broken, the new card details update there too¹.

In a survey of 2,079 members of the public, representative of the UK population aged 18+, with data collected online in March 2026, 61% of those who had been a victim of card fraud in the past two years said they had experienced further fraud on their replacement card within three months of receiving it, though not all of these cases will involve ABU¹.

Which? researchers contacted Amex, Barclays, HSBC, Lloyds, Monzo, Nationwide, NatWest, Santander and Starling to ask to be opted out of ABU. Monzo was the only one to offer an opt-out process controlled by customers during the research¹.

Starling, Monzo and NatWest said that when they cancel a customer's card due to fraud, they fully opt its replacement out of ABU, and Starling also opts cards out whenever they are cancelled by a customer for any reason. Amex, Lloyds, Santander and Nationwide said they block payments and/or ABU updates to the particular merchants involved in the fraud, sometimes called a merchant block¹.

UK Finance said merchant blocks can sometimes have "unintended consequences", and both Mastercard and UK Finance said fraud linked to ABU is low. Visa said banks are responsible for handling the service for each cardholder, including stopping VAU or stopping it for a specific merchant where fraud has been detected¹. Last year, Visa and Mastercard both told Which? cardholders could ask their issuer to opt them out of ABU¹.

Why it matters for households

Anyone whose card details are saved with a merchant or digital wallet is affected by how their bank handles ABU, and the survey evidence suggests repeat fraud on a replacement card is common. Where a bank does not offer an opt-out, a customer cannot stop their new details being passed to saved merchants, and Which? found that in many cases staff appeared not to know what ABU was, even when the correct terminology was used¹. Where a bank applies a merchant block instead, UK Finance said a block applied to stop a fraudster using a card at a merchant could also prevent the genuine cardholder from shopping there¹. Which? reports that unauthorised payments should be refunded in almost all cases, and that customers unhappy with how a bank has handled a complaint can take it to the Financial Ombudsman Service¹. More detail is in our guides to credit card fraud and unauthorised payments and what happens to recurring card payments when you get a new card.

What happens next

Nationwide told Which? it does not currently offer an opt-out from Visa Account Updater but will keep this under review¹. No further dated commitments from the card schemes or banks have been reported.