I recently had an unauthorised transaction applied to my credit card account.  The circumstances have turned it into an interesting test of privacy with my bank.

I had an annual subscription with merchant A, based in Dublin.  They billed a renewal to a credit card number that had been cancelled (0866), without any prior warning and at double the rate of the previous year.  If I had known about this prior to the renewal date I would have cancelled before the renewal date.  No notification was received, either before or after the transaction was processed.  A uses payment provider B.

I see a billed amount on my credit card account applied to my current credit card number (7824).  The record of charge includes the name of the subscription ('Starter') and a number that starts with a +. Google on the number shows a website that supplies the name of the owner of a phone number, this turns out to be A.

The credit card number registered by me as a payment method on A's website is an old (0866), now cancelled, credit card number.  The receipt for the renewed subscription shows the same (cancelled) credit card number.  So how come the transaction was honoured?  Why was it not rejected as an inactive credit card number?

So I take up the issue with my card issuer (NZs most profitable bank).  They explained that the bank routinely advises 3rd-party payment providers (such as B) that credit cards number have been cancelled and replaced (ie when 0866 was cancelled and 7824 issued), so transactions placed against a cancelled credit card number could be modified to be charged to the replacement credit card number.  My only course of action with the bank is to dispute the charge.  This requires me to agree that my current credit card number (7824) be cancelled and a new card issued (9110).  When I asked why, given that the bank would again advise the same payment platform of the change from 7824 to 9910, they just said that is the way it is.  The bank has refused to take any corrective action.

I have raised an issue with the Banking Ombudsman on the basis that the bank has no business advising anyone that a credit card number is no longer is use, replaced by a new number.  Who gets to know about the new number is my sole prerogative, based on where I use the card and merchants I give it to.  Payment providers need only know if a card number is valid or not for payments.

I would be most interested to hear any feedback only from anyone else who may have been through this scenario, and what the result was.