Failed Payment Recovery: Why Dunning Emails Leave Money on the Table (2026)

Every subscription business runs two churn problems that share a dashboard and nothing else. One is a customer deciding you are not worth the money. The other is a card that expired, a bank that declined, or an authentication prompt nobody finished. The first is a pricing argument you may not win. The second is paperwork — and at scale it is the most recoverable revenue you own. Most teams work it by email alone and let the account lapse.

Involuntary churn is an admin failure wearing a churn costume

It is also a large share of the total. Recurly’s published benchmarks, from median annual churn rates across its network in July 2026, give an overall churn rate of 3.60% — a 2.34% average voluntary rate and a 1.25% average involuntary rate; for SaaS, 3.22%, 2.16% and 1.06% (Recurly churn rate benchmarks). Recurly publishes no involuntary share, but on its own figures the arithmetic puts roughly a third of churn on the billing side rather than the decision side.

That third behaves differently. When a payment fails almost nobody has decided anything — they did not see the email, or they meant to deal with it and did not.

Which changes what a contact is for. A win-back has to change a mind — the job we cover in recovering cancelled subscriptions with outbound agents, where the customer chose to leave. A failed-payment contact only has to get someone to finish a two-minute errand. Merging the two is why both underperform.

Not every decline deserves a human. Sort them first.

A soft decline is a temporary refusal that may succeed on a later attempt — insufficient funds, an issuer velocity rule, a processing error. A hard decline is permanent for that card: closed account, stolen card, invalid number. The mix favours automation. In Recurly Research’s 2018 analysis of data from over 1,300 subscription businesses, four of the top five decline reasons were soft declines “which can be repaired by retrying the card,” with Invalid Card Number the only hard decline in that group; the three most common decline messages all had recovery rates over 45% (Recurly Research, October 2018).

Soft declines are therefore an automation problem; hard declines and failed authentication are a communication problem, because only the customer can supply what is missing.

The honest limit: do the cheap things first and most of this disappears

If your recovery programme opens with a phone call you have built it backwards. Three automated layers run first. Card account updater services and network tokenisation keep credentials current when a bank reissues a card — Visa reports that token-based transactions drive “a four percent uplift in authorization,” measured on global card-not-present Visa credit and debit transactions from October to December 2022 (Visa, A Deep Dive on Tokens). Retry logic timed against likely pay cycles rather than a fixed schedule clears most insufficient-funds cases. And pre-dunning — a notice sent before a card expires, not after it declines — turns a recovery problem into a routine update.

A call is not worth it when the failure is a soft decline with retries still to run; when the contact costs more than the account’s remaining contract value; when the customer has opted out; or when you have no account updater running at all, in which case fix that first, because it is cheaper than any conversation. Human contact is for the residue, not the volume.

Your suspension date defines the dunning window

Ask when a dunning sequence ends and most teams name a number of emails. The number that matters is the day the account suspends, because that is when the conversation changes from “update your card” to “come back.” Everything before suspension is admin; everything after is a win-back, with all the resistance that implies. And a sequence that never states the suspension date is asking someone to act on a deadline you have kept to yourself.

Timing has a ceiling. Recurly’s decline research found the majority of recovery happens two to twelve days after the initial decline, so a ladder that has not changed channel inside two weeks has missed its window. A shape that works for a monthly plan:

• Day 0 — email. Automatic, with a one-click secure update link.
• Day 3 — email plus SMS. The first channel change, and usually the biggest step-up in the sequence, because email is where billing notices go to die.
• Day 7 — SMS. Name the suspension date explicitly.
• Day 10–14 — call. Only for accounts worth the contact, and only for failures a retry cannot fix.
• Suspension day — final notice. State what happens to their access and data, and how to restore it.

What the call is, and what it must never be

The call that works is boring. It identifies the business, states one fact, removes blame and hands over a link: we are calling about the payment on your account, the card on file did not go through, this usually happens when a bank reissues a card, we will text you a secure link now so you can update it in about a minute.

Never take card details on the call. Not by voice, not by keypad, and never read aloud to an AI agent. Send the secure link to the number on file and let the customer pay in your own hosted flow. That keeps card data out of recordings and transcripts, and an unexpected caller asking for card numbers is indistinguishable from the fraud their bank has warned them about.

Do not sell anything. The moment a discount enters the script the contact stops being account servicing and becomes marketing, with entirely different consent obligations — see below.

Payment outreach has its own consent position

“We are only helping with their card” does not put the message outside the rules. General information from an operator, not legal advice — have counsel sign this off before you dial.

United States. The TCPA regulates calls and texts to a mobile by technology and content, not by intent, and since the FCC’s February 2024 ruling an AI-generated voice counts as an artificial or prerecorded voice (see our TCPA guide for AI voice and SMS agents). What is specific to billing is where consent comes from. In its 2008 declaratory ruling the FCC held that “prior express consent is deemed to be granted only if the wireless number was provided by the consumer to the creditor, and that such number was provided during the transaction that resulted in the debt owed,” that “calls solely for the purpose of debt collection are not telephone solicitations and do not constitute telemarketing,” and that “the creditor should be responsible for demonstrating that the consumer provided prior express consent” (73 FR 6041). In practice: the number captured at sign-up, not one appended later.

There is an exemption pathway, and it is narrower than people assume. 47 CFR § 64.1200(a)(9)(iii) exempts certain financial-institution messages to wireless numbers, but only for fraud and identity-theft risk, breaches of customer information, remediation and pending money transfers — capped at three messages per event over three days, and an exempt message “must not include any telemarketing, cross-marketing, solicitation, debt collection, or advertising content.” A dunning call is not a fraud alert. Build on sign-up consent, and keep revocation working: opt-out by any reasonable method is already in force, with revoke-all scope due January 2027 (our breakdown). Whether a billing message sits inside your marketing opt-out is a question for counsel.

Australia. Two regimes, both drawing the line at promotional content. The Spam Act 2003 makes a message commercial where a purpose is to offer, advertise or promote goods or services (s 6(1)). Schedule 1 clause 2 designates a message of “no more than factual information (with or without directly-related comment)” plus your name, logo and contact details, and the Schedule’s note records that designated messages “are exempt from section 16 … and section 18” — consent and unsubscribe — while sender identification under s 17 still applies (Spam Act 2003). For calls, the Do Not Call Register Act 2006 defines a telemarketing call at s 5(1) as a voice call where a purpose is to offer, advertise or promote goods or services. Pure account servicing is not that — but the register’s guidance is blunt: if a call “includes a commercial-type purpose, even if it is not the primary or sole purpose of the call or fax”, it is a telemarketing call (Do Not Call Register). Attach a save offer and you are washing against the register and meeting the Telecommunications (Telemarketing and Research Calls) Industry Standard 2017.

The operational answer to both: keep the recovery contact strictly factual, keep any retention offer in a separate consented flow, and log which one you sent.

Where this bites hardest

Involuntary churn scales with how many live payment credentials you hold and how little friction there was at sign-up. Fitness is the classic case — a membership business like Marcus Wilkinson’s Iron Body runs recurring debits against a large base of cards, where a reissued card and a quiet lapse look identical until someone reconciles them. Online education and community subscriptions have the same shape — the category Foundr and SheSells.online sit in — where a fraction of a percent of monthly billing failures is a real number once the base is large.

We run AI voice and SMS outbound for businesses in these categories — 50,769+ AI-booked appointments since 2017, 1M+ leads generated, 25 filmed case studies, 4.6 across 43 Google reviews. What matters here is not persuasion; it is reaching a large set of non-responders on a channel they check, inside a fixed window, without adding headcount. To size the residue in your billing stack, book a call. This page sits inside our SaaS lifecycle revenue outbound playbook.

Frequently asked questions

What is the difference between involuntary and voluntary churn?

Voluntary churn is a customer choosing to cancel; involuntary churn is service lost because a payment failed. Recurly’s July 2026 network benchmarks put average voluntary churn at 2.34% and average involuntary churn at 1.25% of an overall 3.60% (Recurly). Recurly publishes no involuntary share; on our arithmetic against those rates, roughly a third of the problem is billing, and it needs its own sequence.

Is it legal to call or text a US customer about a failed payment?

It is regulated, and the technology matters more than your intentions. AI voices are treated as artificial or prerecorded, so mobile calls need prior express consent. For billing, the FCC held that consent exists where the wireless number “was provided during the transaction that resulted in the debt owed,” with the creditor bearing the burden of proof (73 FR 6041). Sign-up numbers are the pathway; appended numbers are not.

Can I rely on the FCC’s financial-institution exemption for dunning?

Almost certainly not. 47 CFR § 64.1200(a)(9)(iii) covers fraud risk, data breaches, remediation and pending money transfers, and requires that the message carry no “telemarketing, cross-marketing, solicitation, debt collection, or advertising content.” A failed-payment notice is not a fraud alert.

Can an AI agent take the new card number over the phone?

Do not design it that way. Send a secure hosted update link to the number on file — it keeps card data out of recordings and transcripts, and a suspicious customer will actually trust it.

Does a card account updater make recovery calls unnecessary?

It makes most of them unnecessary, which is the point. Updaters and network tokens keep credentials current through reissues. What they cannot fix is a closed account, a fraud block or an abandoned authentication challenge — a much smaller residue than the raw failure count suggests.

See if we’re a fit

Three quick questions. If it’s a fit, our live calendar loads on the next screen. If it isn’t, we’ll point you to free resources instead — you won’t have to sit through a sales call to find out.