Card Data Lock-In: 93% Lack Control of Saved Credentials

PYMNTS reported Oct. 20 that 93% of surveyed companies lack full control over customer payment credentials, which can make switching processors costly.

If you run a high-ticket Shopify store, this lands on a decision you probably made once and never revisited: which processor holds your customers’ saved cards, and what it costs to leave. For readers of Ecommerce Paradise the survey sample is bigger than your store, since it covers companies with $10 million or more in annual revenue. The lock-in mechanics are the same at any size.

Below: what PYMNTS and its survey partner reported, what Stripe and Shopify have said about moving card data, where the evidence is thin, and five questions to put to your processor before Black Friday traffic arrives. I covered the failure side of this in my piece on why your payment processor is a single point of failure. This is the exit side.

Your processor account lives under your business entity, so form the LLC that owns it with Northwest Registered Agent, the best LLC formation service for ecommerce owners. Northwest charges the same renewal price as year one with no upsell ladder, which is the opposite of the cheap formation sites that bury you in add-ons. Form your LLC with Northwest →

Affiliate disclosure: some links in this article are affiliate links and I may earn a commission at no cost to you. It does not change which tools I recommend or what the reporting says.

93% of Surveyed Firms Lack Full Control of Saved Card Data

The PYMNTS article, published Oct. 20, argues that switching providers can depend on who controls saved customer credentials, known as tokens, and the transaction records tied to them. A merchant can negotiate a better processing rate and still face migration work, compliance reviews and technical integration if those credentials sit inside the current provider’s systems, according to the piece.

The numbers come from a PYMNTS Data Book study, “The Orchestration Advantage: Why Five Payment Capabilities Separate Leaders From Laggards”. PYMNTS Intelligence produced it in collaboration with Spreedly, a payment orchestration vendor. It surveyed 110 U.S. companies with annual revenue of at least $10 million between March 16 and March 31, 2026.

Per the study, 93% of those companies lack full control over payment tokens and credentials. Only 7% have it. Most share control with their payment service providers or depend on credentials the provider manages.

The study also ties orchestration, meaning the ability to route payments across multiple providers, to performance. Of the companies with all five core orchestration capabilities, 78% reported transaction completion gains of 2% or more. That compares with 10% of companies with three or four capabilities and 7% of those with one or two. On approval rates, 69% of full-capability companies reached rates above 97%, against 32% of companies with one or two capabilities.

One more figure matters for anyone planning a payments change. According to the study, 72% of companies need significant or full reintegration to add a new payment method, while 18% call it somewhat or very easy.

PYMNTS includes its own caution. The findings do not establish that credential control alone produced the performance gains, the article says. It also lists what a merchant should ask a processor: which records can leave, in what format, how long a transfer takes, and whether the links between customers, credentials and transactions survive the move.

Spreedly’s Vault, Stripe’s Export Policy and the 2022 Shopify Answer

The Oct. 20 article follows a product launch. On July 15, 2026, Spreedly announced a standalone payment vault that lets merchants store and manage customer credentials without adopting its full orchestration platform. The company says the tokens work across more than 100 payment providers.

“The vault has become the control point in modern payments,” Spreedly CEO Justin Benson said in the release. The release also says stored-credential transactions made up 40% of volume on Spreedly’s platform, up from 34% in 2022. It does not state pricing.

Stripe publishes its position in its payment data export documentation. “We believe our customers own the sensitive data they entrust to Stripe,” the page says. Stripe will transfer card data to a new processor, but only one that is PCI DSS Level 1 compliant. The receiving processor must supply a current Attestation of Compliance or a listing on Visa’s Global Registry of Service Providers, plus a PGP public key of 4,096 bits or longer.

The export has limits. Stripe prepares an encrypted JSON file with card details, email addresses and metadata, per the same page. Credentials saved through Link are excluded. Stripe does not export payment history or subscriptions, which you retrieve through the Dashboard or API instead.

Shopify’s side is murkier. A merchant-forum thread titled “Major Issues Transferring Customer Payment Data off Shopify Payments” opened in July 2022. A Shopify staff reply that month said the company was “not able to transfer payment details” and suggested having customers resubmit cards after a migration. Merchants kept adding reports through 2025, and one said Shopify Help sent them to Stripe instead. The latest reply is dated Feb. 22, 2026.

That thread is merchant testimony, not Shopify policy, and I could not find a current Shopify statement that settles it. Treat it as a reason to ask in writing, not as a verdict.

The counterpoint is built into the source. Spreedly sells the thing the survey says merchants lack, and it co-produced the survey. PYMNTS says as much about the causation problem. Nothing in the reporting contradicts the lock-in claim, but the 93% figure comes from a vendor collaboration covering companies with $10 million or more in revenue, not small stores. Payment infrastructure is also moving fast. Visa, Mastercard and Stripe pushed stablecoins further into payments recently. A Google Cloud London outage disrupted Revolut cards. Taken together, that is the argument for keeping your exit options open.

What Card-Data Lock-In Costs a High-Ticket Shopify Store

My read is that this matters less to a one-time-purchase high-ticket store than the headline suggests, and more than most owners assume. A $3,000 patio set or a $2,500 mobility scooter is usually bought once. A customer who never returns is not a saved card you lose by switching processors.

The stickiness shows up elsewhere: repeat buyers, financing, accessory and warranty orders, and anything billed later. If you sell consumables, service plans or installments, saved credentials are the asset. Here is rough math, and it is hypothetical. Say 15% of your monthly revenue comes from returning customers who check out with a saved card. Say a forced re-entry loses a third of them. That is 5% of revenue at risk during a migration, on top of the technical work.

Here are my thresholds, a rule of thumb and not a reported benchmark. Under 5% of revenue from saved-card repeat buyers, portability is a footnote, and your time is better spent on stopping chargebacks before they cost you. Between 5% and 15%, get the export policy in writing. Above 15%, or with any recurring billing, treat portability as a contract term, not a support question.

Owning your credentials also does not mean holding card numbers. Spreedly’s release describes its vault as PCI DSS Level 1 tokenization that keeps raw payment data out of merchant systems. That is the trade: you want portability without taking on the compliance burden of storing cards yourself. For a small store, the sensible target is a processor that can export to another Level 1 processor on request, not a card database of your own.

Financing is a separate case. When a buyer uses Affirm or Klarna, the lender holds the payment relationship, so there is no saved card of yours to port, but there is a cost to weigh. My notes on what higher yields do to your BNPL costs show why. Wayfair’s recent move is the other side of it, covered in Wayfair expands Klarna with 0% APR. Financing share belongs in the same spreadsheet as your saved-card share.

A second hidden cost is data that is not a card number. Dispute history, payout reports and the link between customer and order live in your processor and Shopify. Reconciling them into your books through A2X gives you a copy that does not depend on any one dashboard. A tool like Finaloop does a similar job if you want bookkeeping handled for you.

Use QuickBooks as the ledger underneath if you keep your own books. My QuickBooks walkthrough for online store owners covers the setup.

Stripe’s page makes the gap plain: card data can move, payment history and subscriptions cannot be exported the same way. If a processor change ever lands in the middle of a dispute window, your own records decide the outcome, a point reinforced by Visa’s widened chargeback evidence rules that start Oct. 24.

The Q4 timing is the real risk. Shopify merchants who change payment setups in the weeks before peak traffic take on checkout risk at the worst moment, and I would not touch a live checkout between now and Cyber Monday. Use my Black Friday stress-test checklist to confirm what you have, and schedule any migration for January. Security belongs in the same conversation, since three Shopify apps were hijacked to fake checkouts recently, and a rushed payments change is how a bad integration slips in.

If you would rather not run this yourself, the turnkey done-for-you service builds and runs the store so decisions like processor portability get made once, on purpose, before they become urgent.

Want my team to build and run your high-ticket store, so payments are one less thing on your plate? See the turnkey done-for-you service →

5 Questions to Put to Your Payment Processor Before Peak Season

None of this needs a migration. It needs five answers on record before you need them.

Measure your exposure. Pull 12 months of orders from Shopify and count the share of revenue from returning customers, plus any recurring or installment billing. That one number decides whether anything below is urgent.
Ask for the export policy in writing. Email your processor and ask whether card data can be exported, to which processors, in what format, how long it takes, and what is excluded. Stripe’s documentation is the model for a good answer, including the PCI DSS Level 1 and PGP key requirements. Save the reply.
Back up the data you own today. Export orders, customer emails, payout reports and dispute history on a schedule, and sync them into your accounting with A2X or your bookkeeping tool. Keep a copy outside Shopify.
Add a second place for money to land. A second settlement account means one outage or hold does not freeze cash. Airwallex is one route. Wise is another option for moving money between currencies.
Write the re-entry plan now. If you ever must ask customers to re-enter cards, you want the email and support replies drafted. Build the email in Klaviyo. Save the support reply as a macro in Gorgias.

Run the first two this week. They take an afternoon, and the answers tell you whether the rest is urgent or a January project. If you want a second set of eyes on your answers, that is what 1-on-1 coaching is for.

Frequently Asked Questions

What is a payment token or saved credential?
It is a stored stand-in for a customer’s card that lets them check out again without retyping it. Whoever holds the vault controls whether that data can move, per the PYMNTS article. The same logic applies to Shopify checkout.

Does this affect a store that only sells one-time, high-ticket items?
Less than a subscription business, in my view, because most buyers do not return to reuse a saved card. It still matters for financing, accessory orders and repeat customers. My guide to what high-ticket dropshipping is covers the model, and I treat repeat revenue as the exception when I do the math.

Can I move my cards off Stripe?
Yes, per Stripe’s documentation, to a PCI DSS Level 1 processor that supplies its Attestation of Compliance and a 4,096-bit PGP key. Link-saved credentials are excluded, and payment history and subscriptions are not part of the export.

Can I move my cards off Shopify Payments?
I could not confirm a current Shopify answer. A 2022 staff reply in a merchant forum said it was not able to transfer payment details, and merchants reported similar problems through 2025. Ask Shopify support in writing, and keep a copy of the response.

Is the 93% figure reliable for small stores?
Treat it as directional. It comes from 110 U.S. companies with $10 million or more in revenue, and a vendor that sells vaults helped produce it. The mechanism is real. The exact percentage for a $1 million store is unknown.

Where do I start if I have no store yet?
Pick a niche before you pick a processor. My high-ticket niches list is the place to begin. The free list at /niches gives you a shortlist.

Want to work through this with other store owners and me inside the community? Join the Skool community →

Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day. I am not a financial or legal advisor, so check contract terms with your processor and your attorney before you act on any of this.

If this was useful, these go deeper:

Trevor Fenner

Trevor Fenner is an ecommerce entrepreneur and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.