[tobiasSoftware]

Fun fact. Several years ago I started getting charges from NPM, which although I am a software developer I have never used. I cancelled my credit card multiple times, but they kept appearing each month.

I went to my bank, Bank of America, and they claimed that there was nothing they could do because NPM was using some sort of option they had to follow me when I got new credit cards. I don't know what kind of option that is, as every time I get a new credit card I have to update it with literally every other company. I also don't know how a bank wouldn't have some sort of manual override. Nevertheless, I called NPM, who said I had to talk with my bank. Eventually, after months of dealing with this loop, I threatened to leave my bank, and my bank advised me to call them and threaten to get the BBB involved if they didn't fix it, and a few days later NPM admitted it was an error on their end and reversed all of the charges.

To this day I wonder what kind of shady thing NPM was doing to not just charge someone who had never been a customer of theirs, but to follow them across cancelled credit cards.

[hunter2_]

Ok, I'll bite. There is no way a merchant can learn a new card number other than from the cardholder, or from a thief who got it from the card/cardholder. Not from any upstanding entity.

If you merely got a new expiration date, security code, etc. without also changing the card number, they could "follow" that by submitting a transaction without those extra pieces of information, at greater cost and risk to themselves, though.

I'll happily take downvotes if I'm wrong, for being assertive without a source.

Are you sure NPM was actually charging your card directly, and not a digital wallet or similar virtual card thing which you kept active?

[JohnFen]

Some banks have a service where if you use your card for ongoing regular payments and the card is replaced for any reason, the bank will allow those regular charges to continue on the new card when the service provider uses the old number.

It's very convenient if that's what you want -- it means you don't have to go to all of the ongoing services to update your card immediately. But it does mean that you can't count on changing a card to stop unwanted ongoing charges.

I recently replaced a card at my bank, and they offered this as an opt-in service (which I opted in to), but I hear that some banks make it opt-out, instead.

[piperswe]

According to Stripe,

"Stripe works with card networks and automatically attempts to update saved card details whenever a customer receives a new card (for example, replacing an expired card or one that was reported lost or stolen)."

https://stripe.com/docs/saving-cards#:~:text=Automatic%20car...).

[tobiasSoftware]

I was as shocked as you, and was absolutely infuriated over the bank telling me that they couldn't manually override whatever was going on. I can assure you it was a real thing that happened, and I did cancel my credit card and get a new number, if I remember I tried that at least twice.

I found the email from NPM when they fixed it, though in the email they still claim that my card details were stolen and it should be closed, ignoring that I had done that multiple times already. The email is below. Apparently there were 28 charges, so it must have been around 2 years that this was ongoing, I was dealing with some major issues at that time so I had to put it on the backburner for that time.

As far as digital wallets and virtual cards, I have none of those things. I may be a programmer, but I haven't gone techy with my finances, I just have a checking account and a credit card, and this charge kept appearing on my credit card across at least two card cancellations. Having said that, I have no idea what would happen if a fraudulent digital wallet or virtual card was set up that I was unaware of. The issue did start in 2015 though, so I'm not sure if those even existed back then.

Email from <Redacted>@npmjs.com: "We've completed the investigation into the charges we believe linked to your card ending in [Redacted]. We've refunded each individual charge for a total of $196 (28 refunds at $7/each). You should see those credited back to your account within a few business days.

We've canceled the subscription the charges were linked to, and removed the billing details. That said, we'd still encourage you to notify your bank that the card information was stolen and that the card should be closed.

Thanks for your patience while we worked through this on our end. I understand it wasn't ideal and even frustrating at times. I'm sorry for that.

Please let us know if there is anything else we can do for you. We’ll be here to help."