As other comments have pointed out - the facility to update the details of an expired or cancelled card has been available to merchants / payment providers for

As other comments have pointed out - the facility to update the details of an expired or cancelled card has been available to merchants / payment providers for years if not decades. I do recall that the type of transactions had to be specifically marked as so at the initial authorisation stage ("Continuous Authority" IIRC) and that would allow the initial auth code to effectively be reused. Visa and Mastercard would then provide a service that allowed you to update card details for those that required it (I can't remember if it was push or pull though). I do also recall there was a problem when 3D Secure / Verified by Visa was involved - IIRC while the Continuous Authority transaction type allowed an indefinite length of reuse, 3D Secure / VByV only allowed up to 90 days (may have changed or may be a detail of the spec I'm forgetting). The point is, don't assume cancelling your card will result in cancelling of any recurring debits or allow you to get out of a contract. You have to cancel them with the merchant to make sure they don't continue to charge your new card.