Sending them as marketingThis is the mistake that quietly destroys the whole sequence. A dunning email is a service message about an existing contract, and it has to reach somebody who unsubscribed from your newsletter. If these go out through your marketing suppression list, the customers you most need to reach are the ones who never see them. Send them transactionally and exclude them from marketing suppression, while still honouring genuine account-level opt-outs.
Not matching the emails to the retry scheduleIf your processor retries on days 3, 5 and 7 and your emails go out on days 1, 7 and 14, customers get told a payment failed after it already succeeded. Read the actual retry configuration and hang the emails off the retry events rather than off a fixed timer.
Making them log in to update the cardEvery step between the email and the card form loses recoveries. A tokenised link straight to the update page — short-lived and single-use, so it is safe to email — recovers materially more than 'log in to your account and go to billing'. This is the highest-leverage technical change available in the whole flow.
Threatening on day oneMost first failures clear on the next automatic retry. An immediate warning about suspension generates cancellations and support load from customers who were never at risk, and it burns the credibility you need on day seven when the warning is real.
Continuing after the final noticeYou said it was the last one. Continuing produces complaints against a transactional sending stream, which is far more damaging than complaints against a newsletter — that stream also carries your receipts and password resets, and it cannot afford a reputation problem.
No in-app or SMS backupEmail is one channel and this message matters more than most. A persistent in-app banner costs little and catches the customers who never open email. For high-value plans, a single SMS at day seven is proportionate.