This was a revelation sometimes back and it was Amex (relatively new in India) but I am sure it would be same for any credit card issuer. I had a VPS in Europe that I had emailed the support to cancel about a year ago and they had replied telling me I could do it myself (listed the steps) or they'd need another confirmation from me to go ahead and cancel. I forgot about it.

Got charged some 40 Euro a year later. I was shocked. My first thought was a compromised card. But immediately afterwards I received invoice from VPS provider. I called the bank and asked them how did that happen. They said it's possible. Lucky for me the provider immediately reversed the charge.

The thing is I had cancelled that Amex card almost a year before that charge had happened. It was still charged! I was baffled. Coming from a country where literally every credit card payment has to be authorised via an OTP or password (since as long as I can remember) it was a whole new world for me.

Well, that cancelled card was charged again (almost a year after I had the last experience) when I shopped at AliExpress and forgot to switch to a new card while making the payment. This time I just paid the bill and went around Internet removing that cancelled card.