How to Keep a Client's Card on File (and Answer a Dispute if One Comes)

You finish a color, a groom or a training block, and the client is already halfway out the door. The balance is $85, they want to add a tip, and they picked up a bottle of shampoo on the way out. If their card is on file, you charge it, they get a receipt, and nobody stands at the counter fumbling with a phone.

Keeping a customer's card on file is one of the simplest ways for a service business to get paid in full. It is also one of the easiest to get wrong: a card number scribbled in a notebook, a vague "we may charge your card" line, or a charge the client doesn't recognize three weeks later.

This guide covers what's allowed, what your client should agree to (with wording you can copy), how to charge a card on file the right way, and how to answer a dispute if one ever comes. At the end, we show how it works on Utilica.

Is it legal to keep a customer's card on file?

Yes. Keeping a card on file is a normal, everyday practice, and it's how most subscriptions, hotels and salons already work. What matters is how you keep it and what the client agreed to.

The rules come from three places:

• The card networks (Visa, Mastercard and the rest) expect you to get the cardholder's clear agreement before you store their card for later charges.
• PCI DSS, the card industry's security standard, sets what card data may be kept and how it must be protected.
• Your payment company (Stripe, Square or another) passes both of those on to you through its terms.

Stripe's own guidance for saving a card during a payment is a good plain checklist. Before you save or charge a card, it asks businesses to:

1. Say in your terms how you plan to use the saved card.
2. Say when and how often you might charge it, and how the amount is decided.
3. Use the card only for what you said.
4. Get the customer's explicit consent, such as a "Save my card for later" checkbox.
5. Keep a record of what they agreed to.

If you follow those five points and let your payment company hold the card, you are doing what the rules ask. This isn't legal advice, and some places and industries have their own extra rules, so check if you work somewhere regulated, like healthcare.

When does a card on file make sense?

A card on file works best when the final amount isn't known until the work is done, or when the same client comes back again and again. A few common ones:

For a client, it means they booked and paid up front, and the rest happens without a second checkout. For you, it means the money lands the same day, not when they remember to open your invoice.

If you take a deposit at booking, a card on file is the natural partner: the deposit holds the time, the card covers the rest. Our guide on how to ask a customer for a deposit has wording for that part.

What should a card on file authorization form say?

A card on file authorization form (some people call it a credit card authorization form) is simply the customer's written "yes." It doesn't need legal language. It needs to be specific.

Good consent names your business, says exactly what the card may be charged for, and tells the client how they'll know and how to stop it. Here is wording you can copy and adjust:

I allow Bloom Studio to keep this card on file and charge it later for: the remaining balance after my appointment, tips I choose to add, and products or added services I approve at my visit. I'll get a receipt by email each time, and I can ask Bloom Studio to remove the card at any time.

And a version for a business that bills in blocks:

I allow Riverside Training to keep this card on file and charge it for: each new block of sessions I book, at the price shown when I book it. I'll get a receipt by email each time, and I can ask Riverside Training to remove the card at any time.

A few things make consent hold up later:

• Be specific. "The remaining balance after my appointment" is far stronger than "any amount owed."
• Show it before they save the card, not buried in a terms page they never open.
• Keep the record: the exact words, the date and time, and how they agreed (a checkbox while paying, or a signed agreement).
• Send a receipt every time you charge, with a description of what it was for.

That record is what a bank reads if a charge is ever questioned, so it's worth getting right on day one.

Can I write a customer's card number down?

Please don't. Not on a paper form, not in a notes app, not in a text thread, and never the three or four digit security code on the back.

The PCI Security Standards Council is clear that the security code (CVV, CVC or CID) must not be kept after a payment is approved, even if the customer says it's fine. Their FAQ says card-on-file charges don't need it, and a customer's permission doesn't change that rule.

The card number itself is allowed under PCI DSS only if you protect it the way the standard requires, which is a lot of work for a small business and a real risk if a notebook goes missing or a phone gets stolen.

The safe way is to never see the card at all. Let the customer type it into your payment company's own secure checkout. Stripe or Square keeps the card, and you only ever see something like "Visa ending 4242, expires 08/28." You can charge it, but you can't read it, and neither can anyone who borrows your laptop.

So if you're looking for a "card on file authorization form" to print, use it for the consent words only. Have the client add the card through a secure link instead of writing the number on paper.

How do you charge a card on file?

Once the card is saved with your payment company and you have the client's agreement, charging it takes a minute:

1. Finish the work and work out the amount. Balance, tip, add-ons.
2. Tell the client the total before you charge, in person or with a quick message. No surprises is the best dispute prevention there is.
3. Charge the saved card with a clear description, like "Balance for color and cut, June 12" or "Teeth brushing add-on."
4. Send the receipt right away, with that same description.
5. Only charge for what they agreed to. If something new comes up that isn't in your consent words, ask first or send it as an invoice.

Sometimes a charge won't go through. The card may have expired, the client may be short on funds, or their bank may want them to approve that charge themselves on their phone. When that happens, don't keep retrying. Send a payment link or an invoice so they can pay in a tap, and ask them to add a new card if theirs expired.

What happens when a customer disputes a charge?

A dispute (also called a chargeback) is when a cardholder asks their bank to reverse a payment. The bank takes the money back from you first and then asks for your side.

Here is what Stripe tells businesses about it:

• You have a limited window to answer, usually 7 to 21 days depending on the card network. Miss it and you lose automatically.
• You get one chance to submit your answer. You can't add files later, so send everything at once.
• Banks don't follow links, open videos or call you back. Your evidence has to be written into the answer itself.
• The decision can take up to a few months.
• A dispute comes with a fee from Stripe that isn't returned even when you win.

Some disputes start as an "inquiry," where the bank is only asking a question. Answer an inquiry quickly and fully, because a good answer can stop it from turning into a full dispute.

How do you win a chargeback as a small business?

Not every dispute is fraud. Often it's a client who doesn't recognize your business name on their statement, forgot about a tip, or felt a charge was bigger than they expected. Those are the easiest to answer with good records.

The rule is to answer the exact reason the bank gives, with proof, in plain words. Here's what tends to help for each common reason:

A few habits help every time:

• Contact the client first. An "I don't recognize this" dispute often ends once they remember who you are. Stripe recommends reaching out and keeping a record of what was said.
• Write a short, factual letter. Who bought what, when, what they agreed to, and what they got. No anger, no long story.
• Include the consent record if you charged a card on file: the exact words they agreed to and when.
• Refund when it's fair. If they really were charged twice, or you can't stand behind the charge, a refund costs less than a lost dispute plus the fee.

How do you prevent card disputes before they happen?

Most of the work happens before anyone is upset:

• Write a clear booking and refund policy and show it before people book.
• Get bigger jobs signed. A signed agreement, with when and where it was signed, is strong proof the client agreed.
• Save cards with real consent, using specific wording like the examples above.
• Be easy to reach. Disputes often start when a client can't get hold of you.
• Use a business name clients recognize on their card statement. You set it in your payment company's settings.
• Send a receipt every time, with a description they'll understand later.

Keeping a client's card on file on Utilica

Utilica lets your clients save a card when they pay you, or from a link you send, and lets you charge it later for the balance, a tip or an added service. The card is kept at your own Stripe or Square account, never by Utilica, and you only ever see the brand, last four digits and expiry.

FeatureGet paid the exact amount, in the app they already use.Customers pay you in Cash App, Venmo, PayPal or Zelle with the total already filled in, or by card. Every order is added up, numbered and tracked for you.utilica.app/features/payments→

Cards on file are part of the Pro and Business plans. Here's how to set it up:

1. Connect Stripe or Square. Go to Get Paid, then Payment methods. If you connected Square before November 2026, reconnect it once so cards can be saved.
2. Open Get Paid, then Card payments, then Settings.
3. Choose when to offer it. For card payments, pick "Offer it" and every checkout shows a "Save my card for later" box. For booking payments, choose Off, Offer, or Required, where Required means clients keep a card on file when they book.
4. Write what you may charge it for. Be specific, like "the remaining balance after my appointment and tips I add." Utilica shows you the exact sentence your clients will agree to, in the same shape as the examples above.
5. Save. From now on, clients who tick the box save their card while they pay.

To ask a client for a card without charging them now (with Stripe), go to Saved cards and tap Ask for a card. They get a link, read exactly what they're agreeing to, and add the card on Stripe's own page. Nothing is charged until you charge it. The link works for two weeks. With Square, cards are saved when the client pays and ticks the box.

Charging a saved card

On the Saved cards screen, find the client and tap Charge. Enter the amount and a description like "Balance for the June 12 shoot." The client gets a receipt by email with your description, and the payment shows up in Orders like any other sale.

If a card is declined, or their bank wants them to approve the charge, Utilica tells you why in plain words and lets you send it as an invoice instead. If you lose your connection mid-charge, trying again never charges twice.

The consent record

Every saved card keeps a record of what the client agreed to: the exact words, when they agreed, their internet address, rough location and device, and whether they agreed while paying or from your link. Tap Consent on any card to see it. If a client asks you to remove their card, tap Remove and it's taken off at Stripe or Square too, so it can't be charged again.

Answering disputes on Utilica

Utilica checks your connected Stripe and Square accounts every hour for disputes and bank inquiries, and on Stripe for payments the card company flags as possible fraud. When one shows up, you get an email and it appears under Get Paid, Card payments, Disputes, with how many days you have left to answer.

Open it and you'll find:

• A plain guide to the reason: what the client is claiming and what tends to win it.
• Your answer, already filled in from Utilica's records: the order, the booking and the policy shown before they booked, a signed agreement with when and where it was signed, the card-on-file consent, the receipt you emailed, and how many earlier orders this client paid without a dispute.
• A short letter to the bank drafted from those records, which you can edit.
• Save draft, Send to the bank, or Accept the dispute. Nothing is sent until you send it.

If a payment is flagged as possible fraud before anyone disputes it, you can refund it from the same screen. The Disputes screen also has a short prevention checklist that shows which steps you've already done.

If you're setting up a new client from scratch, the Onboard Flow gets their details, the booking, your signed agreement and the deposit in one link, and all of that feeds straight into a dispute answer if you ever need one. See the pricing page for what's included on each plan, or the pages for salons, barbers, dog groomers and personal trainers.

From the blogHow to ask a customer for a deposit, with wording you can copyHow a deposit works, how much to ask for, and exactly what to say when you ask, for appointments, custom orders and events. Plus how to collect it without chasing anyone.utilica.app/blog/how-to-ask-a-customer-for-a-deposit→

The short version

• Keeping a client's card on file is fine when they clearly agree and your payment company holds the card.
• Use specific consent words, show them before the card is saved, and keep the record.
• Never write card numbers down, and never keep the security code.
• Tell the client the total, charge with a clear description, and send a receipt.
• If a dispute comes, answer the exact reason with records, before the deadline, in one go.