The simple answer is "its very complicated". And it also depends on which CableCARD system is being used (SA, Motorola, NDS) in terms of the configurations and how the pairing and entitlement(s) to services work. In all cases, entitlements eventually expire (that time is configurable), but are refreshed with some of the background messages sent in the out of band traffic constantly. The out of band channel is very low bitrate, and tends to be very low reliability, which is one of the reasons the messages are repeatedly sent all the time in the background. However, in some cases, the signal is so poor that the card entitlements will constantly miss the messages, so expire. When one calls the MSO if they do a refresh/hit it sends the messages again and again and again in the hope the card will get them this time (and they generally do). I believe in the Diagnostics menu one can find the OOB SNR. Higher is always better, but if it is in the teens there may be a signal problem (and if you are using a Tuning Adapter, one needs to look at the Tuning Adapters values). However, there are other failure modes. For Motorola's system, one needs to have the entitlements both on the account, and on the card, so if either is somehow missed or confused the authorizations can eventually disappear. It is possible to get things fixed in a Moto system (if you happen to get a really good CSR who knows CableCARDS), but I have found that it is much easier to just swap the card, as it will inherit the correct settings from the account.