Naar hoofdinhoud
Alle artikelen
OperationsAug 30, 2026

Failed membership payments: how to recover them before members lapse

Many failed membership payments have nothing to do with a member wanting to leave. The card expired or was replaced, the account was short on the day, or the bank wanted the member to confirm the payment. To recover failed membership payments before members lapse, fix what you can automatically with updated card details and well-timed retries, ask the member to act when only they can fix it, and keep their access for a defined grace period while they do.

Each failure reason needs a different response. A generic "your payment failed" email sends a member whose bank wants authentication down the same path as one whose card has been cancelled, and neither is told exactly what to do.

Why do membership payments fail?

Card processors return a decline code with each failed payment. Stripe's codes cover the common causes and what each one needs:

ReasonStripe decline codeCan an automatic retry work?What the member needs to do
Card expiredexpired_cardNot with the same card detailsUse another card, unless an automatic card update supplies the new details
Not enough money in the accountinsufficient_fundsIt can, once funds are availableAdd funds or use another payment method
Bank wants the member to authenticateauthentication_requiredNo, Stripe treats it as a hard declineComplete authentication with their bank, for example through 3D Secure
Card reported lost or stolenlost_card or stolen_cardNo, Stripe treats it as a hard declineAdd a new card
Declined for an unknown reasongeneric_decline or do_not_honorSometimesContact their bank, or use another card

For a hard decline, Stripe keeps the retry schedule but only charges once there is a new payment method. For lost and stolen cards, Stripe advises telling the customer the payment was declined without giving the specific reason.

How does strong customer authentication affect recurring payments?

Under regulation 100 of the Payment Services Regulations 2017, a payment provider must apply strong customer authentication (SCA) when a customer initiates an electronic payment, unless an exemption applies. The FCA's guidance says payments the merchant initiates under a mandate the customer has already given, such as a subscription, are not subject to SCA as long as the customer doesn't need to act to trigger them. Setting up that mandate online does need SCA.

So the member authenticates once, when the card is saved, and later renewals usually go through without a prompt. Stripe's guidance is to authenticate the card when saving it and flag later charges as off-session, and it notes that the bank can still ask for authentication on an off-session payment. The mandate should record the member's permission to take payments, how often they will be taken and how the amount is worked out. If you raise the price beyond what the mandate covers, the FCA says payments at the new price would be unauthorised unless the member agrees to an amended or new mandate.

Card updates and automatic retries

Two processor features recover payments without the member doing anything. Stripe's automatic card updates work with the card networks to refresh saved card details when a bank issues a replacement card, for example after expiry or a lost card report. Coverage depends on the card issuer taking part. Stripe says it is widely supported in the United States and varies by country elsewhere, and there is no way to tell in advance which cards will update.

Retries deal with temporary problems such as insufficient funds. Stripe's Smart Retries choose when to try again using signals such as the best time of day to pay, within a policy you set: a number of attempts over one week, two weeks, three weeks, one month or two months. Stripe's recommended default is eight tries within two weeks. When the final retry fails, the subscription is cancelled, marked unpaid or left past due, depending on your settings.

How long should a grace period be?

A grace period keeps a member's access while the payment is recovered. Make it too short and members lose access over a card that would have updated itself. Make it too long and some members use the club for weeks without paying. Match the length to your retry schedule and billing interval: a monthly gym membership might allow a week or two, while an annual club subscription can justify longer.

Whatever length you choose, set the point at which access stops and keep to it. Check that the payment processor's own cancellation setting won't cancel the subscription before your grace period ends.

What should the recovery message say?

Send the first message soon after the failure and make it specific. Tell the member which payment failed and the amount, what they need to do (add a new card, confirm the payment with their bank, or wait for the retry once funds are in), the date their access will pause, and a direct link to the step. Leave out the decline reason when it relates to a lost or stolen card or suspected fraud.

Follow up as the deadline approaches, and stop as soon as the payment succeeds. Members whose fees are paid by a company or an assistant need a way for that person to add the card, so the request reaches someone who can act on it.

How Tiquo recovers failed membership payments

Tiquo memberships bill automatically through Stripe, with payments, renewals and failed charges tracked in one place. Tiquo's membership payment recovery distinguishes cases such as an expired card, insufficient funds and a payment that needs bank authentication, and gives the member the matching action in the customer portal: complete bank authentication, retry an eligible saved card or replace it. Optional branded recovery emails can direct the member to that step. You enable them in Settings > Notifications and customise the supported copy, including payment and grace-period details.

Recurring paid plans can keep access for a chosen number of days or months after the first failed payment. During that time the membership shows Payment grace and its benefits stay available. Later retries don't extend the original deadline, and a failure still unresolved when the period ends becomes suspended and shows as Past due. Stripe continues to manage the retries, so set its cancellation policy to fit the Tiquo grace period. Recovery also rechecks the current subscription state, so an older failure event that arrives after a successful payment doesn't put the member back into a failed state.

When something needs correcting, staff can change the payment method on file, or refund and re-bill selected past invoices, from the customer profile.

© 2026 Tiquo. "Tiquo" en het Tiquo-logo zijn geregistreerde handelsmerken van Tiquo Ltd.

GDPR · CCPA · PCI DSS · ICO · Cyber Essentials Certified · EU–US DPF · SOC 2 Type II (in progress) · ISO 27001 (in progress)

Security & Operational

  • 99.99% SLA Uptime
  • AES-256 encryption at rest
  • TLS 1.3 in transit
  • AES-256 / TLS 1.3
  • Perfect Forward Secrecy (PFS)
  • HTTP Strict Transport Security (HSTS)
  • 99.999999999% (11 nines) data durability
  • Automated backups
  • DDoS protection
  • Web Application Firewall (WAF)
  • Zero Trust posture
  • Role-Based Access Control (RBAC)
  • Principle of Least Privilege
  • Secret scanning in CI
  • SBOM generation
  • Dependency supply-chain controls
  • 24/7 infrastructure monitoring
  • GDPR Article 22 safeguards
  • Data Protection Impact Assessments (DPIAs)
  • Records of Processing Activities (ROPA)
  • SAML 2.0 SSO
  • EASIE SSO
  • OAuth 2.0 / OpenID Connect (OIDC)
  • SCIM 2.0 provisioning
  • MFA / 2FA enforcement
  • Responsible disclosure / bug bounty programme

Privacy, Data Protection & Statutory Obligations

  • ICO Registered
  • UK Modern Slavery Act 2015 compliant
  • UK Public Interest Disclosure Act 1998 compliant
  • EU Article 27 Representative appointed (Paris, France)
  • Swiss FADP Article 14 Representative appointed
  • UK GDPR compliant
  • EU GDPR/DSGVO compliant
  • UK Data Protection Act 2018 compliant
  • Swiss revFADP compliant
  • CCPA / CPRA compliant (California)
  • VCDPA compliant (Virginia)
  • CPA compliant (Colorado)
  • CTDPA compliant (Connecticut)
  • TDPSA compliant (Texas)
  • OCPA compliant (Oregon)
  • MCDPA compliant (Montana)
  • FDBR compliant (Florida)
  • ICDPA compliant (Iowa)
  • ICDPA compliant (Indiana)
  • TIPA compliant (Tennessee)
  • DPDPA compliant (Delaware)
  • NJDPA compliant (New Jersey)
  • NHDPA compliant (New Hampshire)
  • NDPA compliant (Nebraska)
  • MCDPA compliant (Minnesota)
  • MODPA compliant (Maryland)
  • KCDPA compliant (Kentucky)
  • RIDTPPA compliant (Rhode Island)
  • Canada PIPEDA compliant
  • Quebec Law 25 compliant
  • Alberta PIPA compliant
  • British Columbia PIPA compliant
  • Singapore PDPA compliant
  • Hong Kong PDPO compliant
  • Brazil LGPD compliant
  • Japan APPI compliant
  • Australia Privacy Act / APPs compliant
  • India DPDPA 2023 compliant
  • Thailand PDPA compliant
  • Malaysia PDPA 2010 (as amended 2024) compliant
  • New Zealand Privacy Act 2020 compliant
  • South Africa POPIA compliant
  • UAE PDPL compliant
  • Mexico LFPDPPP compliant
  • Kenya Data Protection Act 2019 compliant
  • Ghana Data Protection Act 2012 compliant
  • Nigeria NDPA 2023 compliant
  • Indonesia PDP Law 2022 compliant
  • Philippines Data Privacy Act 2012 compliant

Global Fiscal & E-Invoicing

  • EN 16931 - EU e-invoicing core standard
  • UBL 2.1 - Universal Business Language
  • Austria - RKSV
  • Belgium - Peppol BIS 3.0 (B2B)
  • Czechia - fiscalization
  • Croatia - Fiscalization 2.0
  • Denmark - Peppol BIS 3.0 (B2B)
  • France - NF525 / LNE / Infocert, Factur-X / PDP, E-Reporting
  • Germany - KassenSichV / TSE, DSFinV-K, GoBD, E-Rechnung B2B (XRechnung / ZUGFeRD)
  • Hungary - Online Szamla
  • Italy - Scontrino, FatturaPA (via SDI)
  • Lithuania - i.SAF / i.MAS
  • Norway - Peppol BIS 3.0 (B2B), SAF-T
  • Poland - KSeF
  • Portugal - ATCUD/QR, SAF-T PT
  • Slovakia - eKasa
  • Slovenia - fiscalization (davcno potrjevanje)
  • Spain - FacturaE, SII, VeriFactu, TicketBAI
  • Sweden - SKVFS (certified cash registers)
  • Argentina - ARCA (Q4 2026)
  • Australia - Peppol PINT A-NZ (Q4 2026)
  • Brazil - NFe, NFCe, NFSe (Q4 2026)
  • Chile - SII Chile (Q4 2026)
  • Colombia - DIAN (Q4 2026)
  • Finland - Finvoice, TEAPPSXML (Q4 2026)
  • Japan - JP PINT (Peppol) (Q3 2026)
  • Malaysia - Peppol Malaysia (Q4 2026)
  • Mexico - CFDI (Q4 2026)
  • New Zealand - Peppol PINT A-NZ (Q4 2026)
  • Peru - SUNAT (Q4 2026)
  • Romania - Peppol (RO e-invoice) (Q4 2026)
  • Saudi Arabia - ZATCA (Q4 2026)
  • Singapore - Peppol BIS 3.0 (Q4 2026)
  • United Arab Emirates - Peppol (5C) (Q4 2026)

Standards & Frameworks

  • Cyber Essentials Certified
  • SOC 2 Type II - audit in progress
  • ISO/IEC 27001 - audit in progress
  • NIST Cybersecurity Framework - aligned
  • NIST Privacy Framework - aligned
  • NIST SP 800-53 / 800-63 / 800-63B - aligned
  • NIST AI Risk Management Framework - aligned
  • CIS Critical Security Controls / CIS Benchmarks - aligned
  • OWASP ASVS & OWASP Top Ten - aligned
  • ISO 25010 (quality) - aligned
  • ISO 31000 (risk) - aligned
  • ITIL - aligned
  • W3C Web Standards - aligned
  • OpenAPI Standard - aligned
  • DevSecOps practices - aligned
  • ePrivacy Directive - aligned
  • EU Whistleblowing Directive (2019/1937) - aligned

Payments Compliance

  • PCI DSS Level 1
  • PSD2 / Strong Customer Authentication
  • 3D Secure (3DS)
  • EMVCo Level 1 & 2
  • AML / KYC controls
  • Sanctions screening (OFAC, UN, EU, HMT)

International Data Transfer Mechanisms

  • EU-US Data Privacy Framework
  • EU Standard Contractual Clauses (Decision 2021/914) - Modules 2 & 3
  • UK International Data Transfer Agreement (IDTA) + ICO Addendum
  • Swiss FDPIC-recognised transfer mechanisms
  • APEC Cross-Border Privacy Rules (CBPR)

Accessibility Compliance

  • ADA (Americans with Disabilities Act) - aligned
  • European Accessibility Act (EAA) 2025 - aligned
  • WCAG 2.2 - aligned
  • EN 301 549 - aligned
  • WAI-ARIA - aligned

Eén platform voor hotels, spa's, lessen, evenementen, restaurants en meer.

Tiquo Ltd
Londen, VK

LinkedInTop Performer Spring

Wij gebruiken cookies

Kies of je cookies voor analyse en advertenties toestaat. Je kunt ze accepteren of weigeren. Als je deze melding sluit, weiger je ze.

Meer informatie