You are correct, payment information should not be removed simply because it has expired.
To quickly address the comments above – there are ways to show the user enough information about a payment method without crossing into storing/revealing problematic info (card type and last 4 are typically fine in the USA, at least). I'll assume your security team is handling how to keep the payment info secure, maybe you're using something like tokens with your payment provider.
Why it's a bad idea to delete expired payment info:
- Users are probably not in your application every single day of the year. The card might expire on a day when they're not around to update it. Or, a card might just start declining when it's maxed out. If you remove the payment information immediately, the user will feel like they're being punished.
- People don't remember things. They might have forgotten which card was associated with the billing transaction, and might have to go through old credit card statements to find out. This happens a lot with corporate credit cards. Major hassle!
- Does your company like selling upgraded accounts? Does it have conversion goals? This is a point where you want to be as frictionless as possible. If the customer just needs to update the expiration date, just let them do that without having to start over from step 1. Because if it's a pain to upgrade, they often won't.
- If you're removing that payment info from the entire system, what happens to other parts of the system that might reference it, like (for example) past invoices or payment history? Now you have to build in logic to find all those null references and work around them.
Bonus reason: Allowing users to recover from errors is one of the ten usability heuristics.
A better approach would be:
- Warn the user when their account is about to be downgraded because of an expiring form of payment.
- Show a banner when they login that takes the user directly to the payment page to make an update. Also briefly explain what they can expect until their payment is restored.
- Keep the expired forms of payment and make it extremely visually obvious to the user that they're non-working. Don't allow them to be selected on checkout.