Credential On File (COF)

What is a Credential On File (COF) transaction?

A Credential On File (COF) transaction is one in which the merchant uses a customer’s previously stored payment information because the cardholder has expressly authorized its storage and use for future purchases.

How does a COF work?

Card data (for example, number or token) is stored after the customer provides it in an initial transaction. The merchant can reuse this information for subsequent purchases without the customer needing to enter it again.

There are two main types of COF transactions:

• CIT (Customer Initiated Transaction): Transactions initiated by the cardholder. The customer directly authorizes the payment using stored data.

• MIT (Merchant Initiated Transaction): Transactions initiated by the merchant. The merchant processes the payment based on a prior agreement with the customer, such as subscriptions or automatic payments.

Why are COF transactions important?

Correctly identifying COF transactions is key under PSD2 regulations, as in merchant-initiated payments, the cardholder is not authenticated in real time.

For this reason, specific security protocols must be applied to ensure the transaction is protected. If transactions are not properly flagged as COF, they may be declined by the issuer, affecting both the customer experience and the merchant’s operations.

A common example of this type of transaction is a monthly subscription to a streaming service, where the merchant securely stores the card data to make automatic charges every month.