The Shopify Payments tokenization model

When a customer places their first subscription order at Shopify checkout, they're consenting to future charges under the terms of the selling plan they selected. Shopify Payments captures their card details and issues a payment instrument token — a reference to the stored card that can be used for future charges without the card number ever being re-entered or stored outside Shopify's PCI-compliant vault. The subscription app uses this token to trigger charges on renewal dates. This means neither you nor your subscription app ever handles raw card data — the entire payment flow is end-to-end through Shopify's infrastructure.

  • Shopify Payments is required for native subscription billing — third-party gateways cannot tokenize for subscriptions
  • Token is scoped to the merchant — it cannot be used by another merchant or transferred between apps without re-consent
  • Card update flows write a new token — the old token is invalidated
  • Shopify handles PCI DSS scope entirely; merchants inherit compliance

What causes payment failures — and why most are recoverable

Not all payment failures are the same. A hard decline means the card issuer has permanently rejected the charge — the card is cancelled, the account is closed, or there's suspected fraud. A soft decline is temporary — insufficient funds, a daily limit exceeded, a bank-side fraud hold triggered by an unusual charge pattern, or a card that technically works but the issuer blocked this specific transaction. The critical insight is that the majority of subscription payment failures are soft declines. Industry data consistently shows that 60–75% of initially failed subscription charges succeed when retried within one to two weeks. This is the revenue that dunning is designed to recover.

Smart retry schedules: timing matters more than frequency

The naive dunning strategy is to retry the card every day until it works or the subscriber cancels. This is wrong for two reasons. First, it increases the chance of triggering fraud detection systems, which can result in the card being blocked entirely. Second, it signals urgency and anxiety to the subscriber — daily decline emails feel like a debt collection campaign. A smart retry schedule uses time windows informed by when soft declines are most likely to resolve: 24 hours after the initial failure (catches overnight bank processing updates), 3–4 days after failure (catches monthly credit cycles resetting), and 7 days after failure (catches the most stubborn temporary holds). Retrying three times on this schedule recovers the vast majority of recoverable failures.

  • Retry 1: 24 hours after failure — catches bank processing updates
  • Retry 2: 3–4 days after failure — catches credit cycle resets
  • Retry 3: 7 days after failure — catches persistent temporary holds
  • No retry after 3 failures: escalate to customer-update flow, don't auto-cancel

Dunning emails: the difference between retention and churn

Every payment failure event should trigger a communication to the subscriber — but the tone, timing, and content of that communication determines whether they update their card or cancel. The most effective dunning emails lead with empathy rather than alarm ('We weren't able to process your order' rather than 'YOUR PAYMENT FAILED'), include a single prominent call-to-action linking directly to the payment update page (not the store homepage), and are sent in your brand voice rather than generic system messages. A well-written dunning sequence consistently outperforms a poorly written one by 20–30% on payment recovery rate, regardless of retry timing.

  • First email: sent immediately on failure, calm and non-accusatory, direct update link
  • Second email: sent after the first retry failure, slightly more urgent, restate the value of their subscription
  • Third email: sent after second retry failure, offer to pause instead of cancel as an explicit option
  • Final email: sent 24 hours before auto-cancellation, last chance to update with clear deadline

Pause vs cancel: protect subscribers who just need time

One of the most impactful operational decisions in a subscription business is what happens when payment fails and the customer doesn't update their card within the dunning window. The binary choice — cancel the subscription or keep retrying indefinitely — is both wrong. The right approach is to pause the subscription for a defined window (typically 14–30 days) and use that window for a proactive reactivation campaign. Paused subscribers have not explicitly cancelled — they are passive churners who, with the right prompt and a simple reactivation link, convert back at rates of 25–40%. Auto-cancelling them on payment failure and treating them as lost destroys this recovery opportunity.

Measuring billing health: the metrics that matter

Billing health is often measured only by failed payment rate, but this single metric misses the operational picture. The metrics that give you full visibility are payment attempt success rate (charges that succeed on first attempt), payment recovery rate (failed charges recovered through dunning), involuntary churn rate (subscriptions lost to unrecovered payment failures), and average days to recovery (how quickly your dunning flow resolves failures). Tracking these separately lets you diagnose precisely where revenue is leaking — whether it's a high first-attempt failure rate pointing to an issuer problem, or a low recovery rate pointing to a weak dunning sequence.