Not just in case of a compromise - many issuers will let things go through to the old # when it expires and a new card is sent out. This can create unforseen p

Not just in case of a compromise - many issuers will let things go through to the old # when it expires and a new card is sent out. This can create unforseen problems that aren't fraud related as well. For example, I had to replace my iPhone at one point, and update my 2FA codes. (Even if you back up your iPhone reguarly, 2FA codes in Google Authenticator are not backed up) Unfortunately, I'd lost my recovery code for one service provider. They wanted the last 4 of my CC a one of the points of data in their verification process. Then told me it was incorrect. Luckily, the CC issuer (who sadly, for security reasons I'd rather not name) had some excellent customer service. They realized that they had been billing the previous card number since it was a known re-occurring payment, and were able to work with me to retrieve the last four digits of the old card number via an old statement, enabling access to my account. I've since moved over all my reoccuring payments to that issuer. (And made a document outlining which merchants have which cards on autopay so I can update them when cards are re-issued + backed up my 2FA recovery codes in a secure, offsite, physical location)