# Stored credentials Source: A stored credential is a payer's card, saved so that you can charge it again. The first payment is the payer's own; every later charge is yours, made without them, and the card schemes set rules for both. ## Customer- and merchant-initiated A **customer-initiated transaction**, a CIT, is a payment that the payer makes themselves, in the payment window. The payer is there, so the issuer can ask them for [3-D Secure](https://docs.gjold.com/learn/3-d-secure). A **merchant-initiated transaction**, an MIT, is a charge that you make on a stored credential, without the payer, as an agreement with them allows: a subscription's monthly fee, a usage bill, or a delayed charge. No one is there to authenticate it, so it is outside strong customer authentication. The schemes tell the two apart by how the acquirer marks each payment, and gjold marks each charge of a subscriber as an MIT on the credential that the payer saved. ## Saving the card The payer saves their card in the payment window, in a payment that is a CIT: always with 3-D Secure, which the issuer may approve without asking the payer anything, and perhaps with a first charge, such as the first month of a subscription. From then on, you charge it with MITs. In the API, a saved card is a subscriber: [Create subscriber](https://docs.gjold.com/v1/subscribers/create) has the payer save it, and [Charge subscriber](https://docs.gjold.com/v1/subscribers/charge) makes an MIT on it. ## The rules for charging The card schemes require, and a payer who disputes a charge will ask whether you had: - **Consent.** The payer agreed to the charges when they saved their card: what you will charge, how often or on what event, and how to cancel. - **Notice.** You tell the payer before a charge that the agreement does not fix, such as a new price, and when a free trial turns into a paid subscription. - **An end.** You stop charging when the payer cancels, and don't charge a card that the issuer has said never to charge again. A charge without these is open to a [chargeback](https://docs.gjold.com/learn/chargebacks), which liability shift does not cover, as an MIT is not authenticated. ## When a stored card stops working A stored card stops working when it expires, or when the bank replaces it, after it is lost or stolen, or when the payer closes the account. Charges are then declined, and trying again does not help: the payer has to save their new card, which they do in the payment window, as the first time. In the API, the payer does so by [renewing](https://docs.gjold.com/v1/subscribers/renew) the subscriber, which keeps its ID, so that your records of it stay as they are. Plan for it: tell the payer before their card expires, from its expiry date, and send them a renewal link when a charge is declined for good. How often you may try a declined charge again is the subject of [Declined charges](https://docs.gjold.com/learn/declined-charges).