You save a user's card so they can buy with one click. You DON'T store the real PAN (16-digit card number), that would put you in PCI Level 1 scope and one breach away from the SEC. Instead you store a TOKEN. Two flavours: a PSP TOKEN (issued by your processor, Stripe, Paystack, and works only with that processor), or a NETWORK TOKEN (issued by Visa/Mastercard/Verve themselves, works across processors and AUTOMATICALLY UPDATES when the cardholder gets a new card). The ledger doesn't change much by token type; the user experience does. Failed payments due to expired cards are 5-10% of subscription churn for fintechs without network tokens.