Direct Debit vs Standing Order vs Recurring Card Payment
A direct debit lets a company pull a variable amount from your account and comes with a guaranteed refund. A standing order is you pushing a fixed amount, controlled entirely by you. A recurring card payment charges your card number rather than your account, and it is the one with the weakest protection — which is exactly why most subscriptions use it.
The distinction people never hear: a recurring card payment does not appear in your list of direct debits. Cancel every direct debit in your banking app and a recurring card payment will keep taking money, because it was never a direct debit in the first place.
At a glance
- Direct debit
- Company pulls, amount can vary
- Standing order
- You push, amount is fixed
- Recurring card payment
- Charges your card number
- Guaranteed refund
- Direct debit only
- Hardest to spot
- Recurring card payment
- Survives a new card
- Recurring card payment
The three at a glance
| Direct debit | Standing order | Recurring card payment | |
|---|---|---|---|
| Shows as | DD or D/D | SO or S/O | Card descriptor, no code |
| Who initiates | The company | You | The company |
| Amount | Can vary | Fixed | Can vary |
| Runs on | Account + sort code | Account + sort code | Your card number |
| Cancel via | Your bank, instantly | Your banking app | Your bank (they may resist) |
| Guaranteed refund | Yes | No | No |
| Typical use | Utilities, council tax | Rent, savings | Subscriptions, apps, gyms |
Direct debit: the one with real protection
A direct debit is an instruction you give a company to take money from your account. The amount can change and the company controls when it is collected — which sounds like the weakest arrangement and is in fact the strongest.
That is because of the Direct Debit Guarantee. If a payment is taken in error — wrong amount, wrong date, one you cancelled, or one you never set up — your bank must give you an immediate full refund. You do not argue with the company. Your bank refunds you and reclaims it from the originator afterwards.
You also have to be told in advance of any change to the amount or date, normally with at least ten working days' notice.
Cancel one by telling your bank, and the cancellation is immediate. Worth knowing: cancelling the direct debit does not cancel the contract. If you owe a gym twelve months, stopping the payment leaves the debt in place — tell the company as well.
Standing order: the one you control
A standing order is you instructing your bank to send a fixed amount on a fixed date. The recipient has no ability to change it, request more, or take it early.
This is why it suits rent and moving money into savings, and why it does not suit anything where the bill varies.
There is no Guarantee attached, because there is nothing to protect you from — nobody can take a different amount than you set. If you send money to the wrong person that is a different problem, and the bank's misdirected payment process applies.
You can cancel a standing order yourself in your banking app, and it takes effect immediately.
Recurring card payment: the one causing the trouble
Also called a continuous payment authority (CPA). You give a company your card details and permission to charge that card whenever they are due. Streaming services, apps, gyms, insurance, most free trials.
Two properties make this the difficult one.
It is invisible in your direct debit list. It runs on your long card number, so it does not appear where people look for recurring payments. This is the single most common reason someone thinks they have cancelled everything and the money keeps going.
It can survive a new card. Visa and Mastercard both operate services that pass updated card numbers to merchants automatically, so replacing a lost card does not reliably stop a CPA. Cancelling the card is not a cancellation method.
There is no guaranteed refund. You have chargeback, and Section 75 if it was a credit card and the item cost over £100 — but neither is automatic in the way the Direct Debit Guarantee is.
Your right to cancel a card payment, which banks get wrong
Under the FCA's rules you can withdraw consent for a recurring card payment by telling your bank. You do not need the company's agreement and you do not need to have cancelled with them first. The bank must act on it.
Banks still tell customers otherwise. If you are told to go back to the retailer, that is incorrect, and it has been since 2013. Ask them to check their obligations on continuous payment authorities, or escalate it as a complaint.
Instruct them before the end of the business day before the payment is due, and take a reference. If they take the payment after you have withdrawn consent, they must refund it.
How to tell which one you are looking at
Check the statement first. A direct debit is nearly always marked DD or D/D, and a standing order SO or S/O. If there is no code and the entry looks like a card purchase that repeats every month, it is a recurring card payment.
If the marking is unclear, the amount is the next clue. A figure that varies month to month is a direct debit or a card payment, never a standing order.
Which to choose when you have the option
For a bill that varies — energy, council tax, phone — a direct debit is the better arrangement despite handing over control, because the Guarantee is worth more than the control is.
For a fixed amount going somewhere you trust, a standing order keeps you in charge and costs you nothing.
For a subscription, you rarely get a choice. Where you do, a credit card gives you Section 75 protection above £100 that a debit card does not.
If one you cannot identify is taking money
Stop it first and identify it second — the two jobs are separate, and the payment will keep going while you investigate.
🛡️ Build your recovery plan
Tick what applies to you. The order below is deliberate: most of these organisations will ask for your Action Fraud reference number, so doing it in this sequence saves you making the same call twice.
Nothing ticked yet: the steps below are the ones that apply to everyone. Tick a box above to add the rest.
- 1
Report it to Action Fraud and get your crime reference number
Action Fraud: the national reporting centre for fraud
- Onlinereportfraud.police.uk
- Phone0300 123 2040
Do this second, and do it before you contact anyone else. Almost every organisation in this list (lenders, credit reference agencies, debt collectors) will ask for the crime reference number Action Fraud gives you, and without it you end up making the same call twice. It also creates the official record you'll rely on if you have to dispute anything later. Expect an update within 28 working days, though that's about the investigation, not about clearing your name; that part is on you and starts now.
Have ready: What happened and roughly when · Any account or reference numbers involved
- 2
Get all three credit reports and read every line
Experian, Equifax and TransUnion
- Experian0800 013 8888
- Equifax0800 014 2955
- TransUnion0330 024 7574
All three, not one. Lenders report to different agencies, so a fraudulent account can sit on one file and be invisible on the others: checking a single report is the most common way people miss the second and third account. You're looking for accounts you didn't open, searches you didn't authorise, and addresses linked to your name that you've never lived at. That last one matters more than it sounds: a linked address you don't recognise is often how the fraud was set up in the first place.
Have ready: Your addresses for the last six years
- 3
Add a CIFAS protective registration
CIFAS: the UK fraud prevention service
- Onlinecifas.org.uk
- Phone0330 460 9601
This puts a warning flag against your name in the National Fraud Database, so member organisations run extra identity checks before granting credit in your name. It costs £30 and lasts two years. It does not affect your credit score, and it doesn't touch accounts you already hold, but it will make your own applications slower, which is the trade-off. If someone has your details, that's usually a trade worth making. Note that not every application is checked against the database, so treat it as a strong deterrent rather than a lock.
- 4
Check you're on the electoral register at the right address
Your local council
A quick one that's worth doing while you're here. The electoral roll is one of the main ways lenders confirm you live where you say you do, and being missing from it both weakens your own applications and makes it easier for someone to claim your identity elsewhere.
- 5
Escalate if you get nowhere
Financial Ombudsman Service, or the ICO
- Financial Ombudsman0800 023 4567
- ICOico.org.uk
If a bank refuses to refund you, or a lender won't remove an entry it has accepted is fraudulent, complain to the firm first and give it eight weeks. After that, or as soon as you get a final response, take it to the Financial Ombudsman. It's free and its decisions bind the firm. Where the argument is specifically about inaccurate data staying on your credit file, the Information Commissioner's Office can also look at it. Both routes cost you nothing.
- 6
Close the door behind you
You
Change passwords on your email account first, not your banking: email is the master key, because it's where password resets land. Turn on two-factor authentication wherever it's offered. If documents were lost or stolen, report the passport or driving licence to the issuing body so it can be flagged. And set a reminder to re-check your credit reports in three months: fraudulent applications sometimes surface long after the original breach.
Contact details and process reflect Action Fraud, CIFAS, the credit reference agencies and National Debtline guidance for England and Wales. Scotland reports fraud through Police Scotland on 101 rather than Action Fraud; the rest of the process is the same. General information, not legal advice: free, independent help is available from National Debtline, Citizens Advice and StepChange.