How Recurring Charges Actually Work (and What Rules Control Them)

You signed up for something, maybe a free trial, maybe a subscription you kept meaning to cancel. Now a charge shows up on your statement every month and you're not sure who to call or how long you have. Your options depend on how you paid, when you noticed, and whether you've got a paper trail. A credit card gives you a statutory dispute right under federal law. A debit card gives you less. A merchant refund request gives you only whatever the company decides to offer. Understanding which rule controls your situation is how you stop wasting time on the wrong path.

Recurring charges run on a simple mechanism. A merchant gets your payment info once, then bills you on a schedule until you cancel. The card networks, your bank, and the merchant each play a role. Which rail your payment runs through determines what rules apply when something goes wrong.

The legal backbone for U.S. consumers is the Restore Online Shoppers' Confidence Act, ROSCA. Passed in 2010, it requires sellers to disclose material terms before billing, get your express consent, and provide a simple cancellation mechanism. The FTC enforces it.

In October 2024, the FTC finalized an updated Negative Option Rule nicknamed "click to cancel." It would have required cancellation to be as easy as signup, in the same medium. The rule took effect January 14, 2025, with full compliance deferred to May 14. Then the Eighth Circuit vacated the entire rule on July 8, 2025, finding the FTC had skipped a required preliminary regulatory analysis for rules with $100 million-plus annual economic impact.

That vacatur didn't leave consumers unprotected. ROSCA never depended on the rule to exist. Two months after the court struck the rule down, the FTC announced a $2.5 billion ROSCA settlement. Visa and Mastercard's own rulebooks still require clear disclosure for free trials and recurring charges, enforced through chargebacks and merchant monitoring programs. The FTC has even used ROSCA against payment processors, not just the sellers themselves.

In March 2026 the FTC started over with an advance notice of proposed rulemaking. No proposed rule has been published as of September 2026.

The current framework still rests on three things: ROSCA as the federal statute, card network rules enforced through your issuing bank, and Section 5 of the FTC Act as a general prohibition on unfair and deceptive practices. State automatic renewal laws add a second layer in California, Colorado, and several other states. The click-to-cancel rule that would have unified these into one federal standard is gone for now.

For credit card disputes, the Fair Credit Billing Act gives you 60 days to dispute a billing error after the statement date. That's a statutory right, not a merchant policy.

What Actually Happens When You Try to Fight a Recurring Charge

The textbook version sounds clean. You spot the charge, you call your bank, you file a dispute, you get your money back. Real disputes rarely move that smoothly.

Most people hit a wall somewhere in the middle, and it's almost always a process problem, not a legal one. Turns out the bank asks for proof you canceled, but the company never sent a confirmation email. Or you canceled online, the company claims the cancellation didn't register, and the charge posted anyway. Or you won the first chargeback, the merchant re-presented the charge, and now your bank wants documentation you didn't know to save.

Your payment method shapes the outcome more than most people expect.

A credit card dispute has a defined path under the Fair Credit Billing Act. A debit card dispute runs through Regulation E, which has tighter timelines and puts more burden on you to act fast. ACH pulls from checking accounts sit in a slightly different lane. Merchants operating through PayPal or a marketplace platform add another layer entirely, because the platform's own dispute policy sits between you and a bank chargeback.

Authorization history matters enormously here. If you handed the merchant your card number and agreed to a free trial, most banks treat the original authorization as consent, even if the merchant never clearly disclosed the recurring amount. That gap between what the law intends and what a dispute team approves on a Tuesday afternoon is where most people get stuck.

Your Dispute Timeline: What to Do and When

Start the clock the moment you notice the charge.

Days 1-2: Cancel and document. Cancel through the same method you used to sign up. If you enrolled online, the FTC's click-to-cancel enforcement standard says the business must let you cancel online too, and while the rule itself was vacated, that standard still shapes how the FTC evaluates ROSCA cases. Take a screenshot of the cancellation confirmation. No confirmation page? Write down the date and time. That gap becomes evidence.

Days 3-5: Contact the merchant in writing. Email or message the company directly. Ask for a refund of the disputed charge. You're building a paper trail here, not hoping for goodwill. Keep the exchange.

Days 6-10: File with your bank or card issuer. Call the number on the back of your card and tell them you want to dispute a recurring charge. For credit cards, the Fair Credit Billing Act gives you 60 days from the statement date. Debit card timelines are shorter and the protections are weaker, so don't wait.

Days 11-30: Monitor and escalate if needed. Check your next statement for a provisional credit. If the bank sides with you, know that the merchant can still challenge. If the bank denies the dispute, ask for the reason in writing and consider filing a complaint with the CFPB at consumerfinance.gov.

Pitfalls That Sink Disputes

Canceling the card but not the subscription is the most common mistake people make. The merchant can still charge a new card number if your account stays active. Some issuers will actually forward updated card details to merchants through automatic account updater services, which means the charge can follow you to your new card without anyone alerting you.

Waiting too long kills cases too. The credit card dispute window is 60 days from the statement date, not the charge date. Miss it and the bank can refuse the dispute outright. There's no appeal for a blown deadline.

Thing is, skipping the merchant contact step hurts you at the bank level. Banks often ask whether you tried resolving it directly first. If you haven't, they may deny the claim or sit on it while they tell you to try the merchant first.

If you need a broader reference point for consumer protection complaints and escalation routes, consumoteca.com.co covers dispute frameworks across multiple consumer topics that connect to the same core process described here.

Frequently Asked Questions

Can I dispute a recurring charge if I forgot to cancel?

You can file a dispute, but forgetting to cancel weakens your case. The card issuer may rule that the charge was authorized since you signed up and didn't cancel. Your strongest argument is that the cancellation process was unreasonably difficult or hidden from you.

How long does a chargeback refund take?

Most banks issue a provisional credit within 10 business days of filing. The full investigation can run 60 to 90 days. If the merchant contests the chargeback, expect it to stretch further.

What if the bank denies my dispute?

Ask for the rejection reason in writing. Then file a complaint with the CFPB. The CFPB forwards complaints to your bank, and the bank has to respond. That second review sometimes goes differently than the first.

Does the click-to-cancel rule apply to all subscriptions?

The FTC rule covered negative option programs broadly, but the Eighth Circuit vacated it in July 2025. The underlying ROSCA statute still applies regardless of the rule's status, and state automatic renewal laws add a second layer in many states. California and Colorado both have active statutes on this.

If your bank has denied a dispute and the merchant won't engage, a CFPB complaint is the most direct escalation path available to you right now. File it, attach whatever documentation you have, and let the process run.