A failed payment is not a cancellation

A meaningful share of SaaS churn is not a decision. It is a card that expired, a bank that declined a foreign charge, or a corporate card that got reissued after a breach. The customer still wants the product. Nobody told them anything went wrong.

The industry word for fixing this is dunning, which sounds like debt collection and gets designed like it. It should not be. Done properly it is a service message: something we could not charge, here is the one button that fixes it.

What "silently extends access" costs you

Before this work, a past-due subscription here simply kept working. That is the friendly default and it is also the worst one, because:

• The customer never finds out their card is dead, so they never fix it.
• You keep serving them for free, indefinitely.
• When you eventually notice and cut them off, it arrives with no warning at all.

Being nice at the start makes you look arbitrary at the end.

The flow

The provider retries a failed charge on its own schedule. We follow along rather than inventing a second one.

1. First failure. An email that says which card failed, what it was for, and links straight to the update-payment page. No account jargon, no invoice PDF to open first.
2. In-app banner. Anyone in the workspace who can pay sees it on every page. Members who cannot pay see nothing, because a banner you cannot act on is just anxiety.
3. Retries. Each provider retry that fails moves the case forward one step. The email changes with it, and says how long is left.
4. Grace period. Access continues, with the warning visible, for a fixed window.
5. Downgrade. At the end of the window the workspace drops to the free plan. Data is untouched. This is reversible the moment a payment succeeds.

Bounded, at every step

The rule we kept coming back to: every state has an exit.

The email sequence has a fixed length, so a broken card cannot generate mail forever. The grace period is a number in configuration, not an open-ended "when someone notices". The downgrade is a state, not a deletion, and a successful payment moves the subscription straight back out of it. That last one was a bug for a while: we handled recovery from past_due but not from downgraded, so a customer who paid late stayed downgraded until somebody intervened by hand.

Say the amount

The single highest-leverage detail in a dunning email is naming the amount and the card. "We could not charge your Visa ending 4242 for £29" gets acted on. "There was a problem with your subscription" gets ignored, because it reads like every phishing email that person has ever deleted.

Be specific, link directly to the fix, and stop emailing when the sequence ends. That is the whole design.