How would this be tooled? A chargeback, a deep link to the cancel page, an API connection between bank and subscription?

Chargeback is easy because it's under the card co's control. Deep link would require knowing the cancel page of every sub, plus handling auth factors. API connection would two way integration, with scoped auth between every bank and every service. Hopefully managed by an SI or aggregator, but the business model sounds hard (the bank doesn't mind the chargeback, the SaaS doesn't want the cancelation, so who pays?)

Visa/MasterCard/Amex already support such a facility in India due to RBI requirements. Doesn't seem too difficult to adapt similar functionality for other countries too, if the regulations are updated to require it.

* https://www.visa.co.in/about-visa/newsroom/press-releases/vi... * https://pgi.billdesk.com/web/sihub

Considering they are placing the charges in the first place, it would seem like it would just need to be a response code, not a convoluted network of extensive new development like you suggest.

> an API connection between bank and subscription?

This already exists. Mastercard (and Visa?) has an API that lets banks notify subscriptions when your card changes to update the card number https://developer.mastercard.com/product/automatic-billing-u...

Integrations are usually one-way (merchant calls bank API), but it's not beyond the bounds of practicality to keep a handle on whatever UID was assigned to the recurring payment in the first place, then send the merchant "by the way this subscription UID requested user cancellation".

This is another instance where we clearly need a regulator to make things work better for the consumer.

> How would this be tooled? A chargeback, a deep link to the cancel page, an API connection between bank and subscription?

I'd be happy to just have the ability to easily ask the credit card company block further payments with no actual notification to the business besides that the monthly charges stop going through. If you want to be fancy about it, creat a custom industry standard declination reason for that use case.

> Deep link would require knowing the cancel page of every sub, plus handling auth factors.

All it needs is a "payment refused, user canceled service" response to billing and not to flag the billing attempt as fraud.

Neobanks definitely have this feature. For example Revolut. There’s a “Block future payments” button, and once you click it, no more charges from that merchant will go through.

Yes, but this is not a correct way to unsubscribe. They might for instance still send a bailiff to collect their money.

What I'm talking about is an official way to unsubscribe. One that the user fully controls, and is free of dark patterns.

What if you want to change your subscription level, rather than unsubscribe?

The requested feature is more like list-unsubscribe headers for mailing lists[1]. Instead of categorizing the mail as spam (blocking) you send a clean unsubscribe back to the sender.

[1] https://www.twilio.com/en-us/blog/insights/list-unsubscribe

The reason isn't technical. This isn't implemented because the entire card-processing ecosystem is hooked on the chargeback fees (min $15 to $100). It starts becoming a lucrative revenue stream for Visa/Mastercard/Stripe/Adyen/WorldPay/Fiserv and the entire ecosystem.

Merchant's end up getting the short end of the stick in most cases.

I love love love this comment.

Banks are barely running on a modern stack, let alone doing anything userful within banking, and you want them to build an api to cancel an outside service? :)?

Love this so much, most HN comment ever :)

PayPal does this. It's one of the greatest features they provide. Hardly an impossible feat.

they just stop payment, that isn't cancelling

your bank really doesn't offer stop payments?

nope, and that isn't cancelling

Thats how it works in India. All authorized repeating charges ("mandates") are listed on a portal maintained by the card issuer. you can go in anytime and simply cancel the mandate from there. This is mandatory under banking regulations.

Credit cards are also required to be "tokenized" when stored at a merchant or payment aggregator - the user authorizes the bank to allow the merchant or the aggregator to "store" the card details for use later, and the bank then issues a card token, tied to the specific merchant/aggregator. They are not allowed to store the original card info at all - just this token. This makes the token not worth stealing, as it can be only used by that merchant, and is trivial to de-auth if needed, with or without merchant cooperation.