What a Car Wash Scandal Taught Us About Automated Billing and Business Accountability

Last week, TMJ4 News ran an investigation into Tsunami Express Car Wash — a southeast Wisconsin chain whose customers were getting charged even after canceling their memberships. Broken cancellation links. Reinstated accounts. Unauthorized charges weeks after confirmed cancellations. One customer waited two weeks for a reply after emailing five times. Another was billed for seven straight months on a membership he says he never authorized.

TMJ4 interviewed ValorTech CEO Bryan Sevener as part of their investigation. Below are his key takeaways — for consumers and business owners alike — on what this story really reveals about billing security, deceptive interfaces, and the systems most companies never think to audit.

Tsunami Express's official explanation was that they had "recently transitioned to a new Point of Sale system" and that "billing and communication gaps occurred" during the migration. That explanation is plausible. It's also a textbook example of what happens when businesses treat a technology migration as a logistics problem rather than a security event.

Every time a business migrates to a new POS or billing platform, payment tokens, subscription states, and cancellation records have to transfer cleanly. If the data mapping is sloppy — or if the new system interprets a "canceled" status differently than the old one — real customers get real charges they didn't authorize. It's not malicious. But it's not acceptable either.

The question every business owner should be asking before a migration isn't "will this work?" It's "what happens to my customers' billing data if something goes wrong — and how will we know?"

One of the most telling details in the TMJ4 investigation was this: the cancellation link on Tsunami Express’s website didn’t work. It either failed silently or looped users back to the home page. Most people clicked it, assumed something went wrong on their end, and tried again. Some gave up. That’s exactly what a well-designed deceptive interface counts on.

This is one of the most underappreciated threats in cybersecurity: the weaponization of familiarity. Cybercriminals — and, in some cases, companies with bad intentions — study the exact screens you interact with every day. Login pages. Account settings. Cancellation flows. They replicate the look, the feel, and the language of legitimate interfaces precisely because your brain is wired to trust what looks familiar. A button that says “Cancel Membership” but does nothing is more dangerous than a button that’s missing entirely, because it creates the illusion of action where none occurred.

“Cybercriminals don’t need to break down the door if you’ve already left the window open. A familiar-looking screen is all it takes.”

— Bryan Sevener, CEO, ValorTech

In the security world, we call the broader category of these tactics dark patterns — interfaces engineered to obstruct user intent rather than enable it. Whether the intent is criminal (phishing pages that mirror your bank’s login screen) or commercial (a cancellation flow designed to time-out before you can complete it), the mechanism is the same: exploit the trust your brain extends to familiar-looking screens. The result is that users hand over credentials, payment data, or continued billing authorization without ever consciously agreeing to do so.

From a compliance standpoint, a broken cancellation flow is not just a UX bug — it’s a billing integrity failure. PCI DSS requires businesses to maintain verifiable records of customer consent and transaction authorization. If your system confirmed a cancellation that never processed, no amount of “system migration” language will insulate you from that legally.

In the security world, we call this a dark pattern — a system designed (intentionally or not) to obstruct user intent. Whether it's a bug or by design doesn't actually matter from a compliance standpoint. If a customer cannot exercise their right to cancel, and they continue to be charged, you have a billing integrity problem with real legal exposure.

PCI DSS — the Payment Card Industry Data Security Standard — requires that businesses maintain accurate records of customer consent and transaction authorization. A broken cancellation flow that results in unauthorized charges isn't just a customer service failure. It's a compliance failure. Depending on volume, it can trigger card network penalties, chargeback thresholds, and in some cases, state consumer protection scrutiny.

In any subscription billing system, there's an automated process — a script, a job, a webhook — that actually initiates the charge against a stored payment method. In a well-designed system, that process is governed by clear rules: what account states are eligible to be charged, what triggers a charge, and what constitutes valid, ongoing authorization.

When accounts that were explicitly canceled get reinstated and charged — as multiple Tsunami Express customers reported — it means that authorization logic broke down somewhere. Either the "canceled" flag wasn't migrated correctly, or the new system had a different definition of what "canceled" means, or there was no audit mechanism in place to catch the discrepancy before charges went out.

This is a principle we call least privilege access: the idea that any automated process should only be able to act within tightly defined boundaries, and that those boundaries should be regularly audited. Applied to billing:

•      Only accounts with an active, verified subscription status should be eligible for recurring charges.

•      Cancellation events should write to an immutable log — not just update a mutable status flag.

•      Any system migration should include reconciliation testing that specifically validates canceled account states before going live.

When TMJ4 asked us what everyday people should do to protect themselves, our advice was practical:

•      Ask the right questions before handing over your card. "What is your cancellation policy?" "Do you store my payment information after the transaction?" "Will you notify me before charging me again?" Businesses that can't answer these clearly are a yellow flag.

•      Use a virtual card for subscriptions. Most major banks now offer virtual card numbers you can generate specifically for recurring charges — and turn off the moment you want to cancel, without waiting for a replacement card. This is one of the most underused consumer protections available.

•      Never put subscriptions on a debit card. A consumer protection attorney quoted in the TMJ4 story made this point clearly — credit cards offer significantly better dispute rights than debit cards when unauthorized charges occur.

•      Keep your cancellation confirmations. Screenshot them. Save the emails. If a company later claims your account was never canceled, you want a paper trail.

If your business uses recurring billing — a membership, a retainer, a subscription box, a SaaS product — the Tsunami Express situation is worth sitting with. Not because your company is doing anything wrong, but because the systems that govern these charges are often set up once and rarely audited.

Questions worth asking your team or your vendor today:

•      If we ran a report of every customer who has been charged in the last 90 days, could we verify that every single one of them has an active, authorized subscription?

•      What does a cancellation actually do in our system — and has anyone tested it recently?

•      If we migrated to a new POS or billing platform tomorrow, what's our process for validating that customer account states transferred correctly before we start charging?

•      Do we have alerting in place to flag unusual billing patterns — like a spike in charges that coincides with a system change?

If you're not confident in the answers, that's not a criticism — it's an opportunity. These aren't exotic security concerns. They're the basics of running a billing sy

Automated billing systems are powerful — and they're essentially unsupervised. They run in the background, touching your customers' money, often without a human reviewing individual transactions. That's fine, as long as the underlying logic is sound, the authorization controls are tight, and someone is actually watching.

When those things aren't in place, you don't get a slow leak. You get a situation where people are emailing five times with no response, disputing charges with their banks, and warning their community online about your "shady business practices" — to quote one of the customers in the TMJ4 story.

Trust, once lost, is expensive to rebuild. The technical fixes, by comparison, are cheap.