That's done with a credit card updating service - not by just ignoring the CVV/expiration.
If the same number were reassigned to someone else, the subscription wouldn't transfer.
If the same number were reassigned to someone else, the subscription wouldn't transfer.
These subscriptions are supported by look at if the payment appeared as a “card-on-file” payment, and many banks will just keep accepting charges to expired cards.
If you’re lucky they’ll be using the PAN + expiry date to uniquely identify the card the payment belongs too.
The CVV isn’t stored by the merchant or their processor, and is only used for the initial checkout flow.
In the EU this sort of behaviour is now heavily frowned upon, and with the slow roll out of Strong Customer Authentication will become unacceptable. With banks needing to prove that they’re compliant.
As for the rest of the world, regulators don’t always act with the interest of customer in mind. The US has a few notable examples of regulators protecting companies rather than consumers.