Also, sometimes getting a new credit card will still have the same number, just a new expiration date and security code.
Also take note that a recognized payments processor using the bank's api does not need to prove anything when they create a new recurrent payment on your account. They can do so at will. The bank relies solely on you noticing and disputing that claim. Services that consult you in becoming such a processor stress this as a 'feature' accompanied by abundant nudges and winks.