A credit card the customer never asked for, or a credit limit that rises without a word, are two sides of the same problem — credit extended without consent. Leading regulators now require the customer to say yes first.
There is a particular kind of consumer harm that arrives dressed as generosity. A card lands in the mailbox already issued. A credit limit quietly increases, “as a reward for good standing,” expanding the customer’s capacity to borrow — and the issuer’s interest income — without any request. Both practices push credit onto people who did not seek it, and both can nudge a household toward over-indebtedness while looking, superficially, like a favour. The regulatory response has been to insist on a simple principle: credit should follow consent, not precede it.
Best Practices
India has the most emphatic regime. The Reserve Bank’s Master Direction bans the issuance of unsolicited cards and unsolicited upgrades outright. Where a card is issued or an existing card upgraded without consent, activation requires the customer’s one-time-password consent, and if an unsolicited card is issued and billed, the issuer faces a penalty of twice the value of the charges — a deterrent with real teeth. Consent is not a formality; it is a precondition, and violating it is expensive.
The United Kingdom targets the quieter half of the problem. Under FCA rules, customers must be able to opt out of automatic credit-limit increases, and issuers are barred from raising limits for customers who are in persistent debt. The limit is treated as something the customer should control, not something the bank can expand unilaterally when it suits its own growth.
Saudi Arabia’s central bank takes a similarly firm line at origination, requiring that a card may not be issued without an explicit request from the customer. Across these regimes the message is consistent: extending credit — whether a new card or a larger limit — is a decision that belongs to the customer.
The transparency gap
Many frameworks address these situations through general conduct expectations rather than an explicit, dedicated rule. There may be no express prohibition on unsolicited card issuance, no specified consent gate for automatic credit-limit increases, and no activation-consent mechanism of the kind India mandates. The customer is protected by broad conduct architecture, but not by a rule that speaks directly to the act of extending credit without a request.
This is a notable gap because it sits at the intersection of two things good frameworks already care about: conduct and affordability. An unsolicited card or a silent limit increase expands a customer’s borrowing capacity outside the very affordability assessment that responsible-lending rules are built to enforce. Credit granted without a request is, almost by definition, credit granted without a fresh affordability check.
The scope for reform
The improvement aligns cleanly with priorities that consumer-protection frameworks already hold. Good practice points to:
- A prohibition on unsolicited card issuance and upgrades, so that no card is issued, and no product upgraded, without an explicit customer request — following the Saudi and Indian models.
- Explicit consent for credit-limit increases, with a customer right to opt out of automatic increases, and a bar on increasing limits for customers showing signs of financial stress, drawing on the UK approach.
- Activation consent for newly issued cards, echoing the OTP-based safeguard that has proven effective elsewhere.
Each of these fits within standard conduct provisions while reinforcing affordability discipline — ensuring that every extension of credit passes through the same gate of request and assessment, rather than arriving unbidden.
The trade-off is largely a commercial one: unsolicited issuance and automatic limit increases are growth tactics, and constraining them removes a channel of expansion. But growth built on credit the customer did not choose is exactly the kind of growth a consumer-protection regime is designed to question. Requiring consent does not stop a willing customer from taking a card or a higher limit; it simply ensures the customer, not the issuer, initiates the decision.
Credit extended without a request is a small door through which larger problems enter. Closing it — by making consent the precondition for both new cards and larger limits — completes the arc of a framework that already assesses affordability with care. It is the logical companion to every other reform in this series: each, in its way, is about ensuring that the customer holds the pen.
Leave a Reply