Authorization Rate

The authorization rate, also called the approval rate or acceptance rate, is the percentage of card payment attempts that are approved. Each time a customer pays by card, the merchant's provider sends an authorization request through the card network to the bank that issued the card, and that bank approves or declines it. The authorization rate measures how often the answer is yes.

Merchants, acquirers and payment service providers watch the figure closely because every declined payment from a genuine customer is a lost or delayed sale. A difference of one or two percentage points is significant for a large online business. The rate reflects decisions by the issuer, but it is strongly influenced by how the merchant and its providers present each transaction.

The standard calculation is:

If a merchant submits 20,000 authorization requests in a month and 17,400 are approved, its authorization rate is 87%. The figure is sensitive to what is counted. Some companies count every attempt, including retries of the same purchase; others count each order once and treat it as approved if any attempt succeeds. Payments blocked by the merchant's own fraud rules, or abandoned during authentication, never reach the issuer and may or may not be included in the denominator. Comparisons between providers are only meaningful when the same definition is used.

The issuer returns a decline code with each refusal, although the codes are often vague. Refusals fall into two broad groups. A soft decline is temporary: insufficient funds, a limit reached, a technical fault or a request for authentication. A hard decline is permanent for that card: it has been reported stolen, closed, or the number is invalid.

Many declines are generated by the issuer's fraud models and say only that the bank chose not to honour the request. Issuers see incomplete information about the purchase and tend to be cautious about transactions that look unusual for the cardholder, particularly those from foreign merchants.

• Channel. In-store payments with chip or contactless are approved far more often than card-not-present payments, where fraud is higher.
• Geography. A transaction is more likely to be approved when the acquirer is in the same country as the issuer. Cross-border transactions are declined more often.
• Card type and funding. Debit and prepaid cards fail more often for lack of funds than credit cards.
• Merchant sector and reputation. Issuers apply stricter rules to some merchant category codes and to merchants with a history of fraud or disputes.
• Transaction type. Recurring charges on stored cards fail when the card has expired or been replaced.
• Data quality. Missing or mismatched fields, such as address or security code, reduce the issuer's confidence.

Several techniques are in common use. Local acquiring routes transactions through an acquirer in the cardholder's country so that they appear domestic. Network tokenization replaces the card number with a token that the network keeps current when a card is reissued, and issuers tend to approve tokenized transactions at a higher rate. A card account updater service refreshes stored card details before a recurring charge.

Authentication with 3-D Secure 2 can raise approval by giving the issuer more data and shifting fraud liability, though a challenge step also causes some customers to drop out. After a soft decline, a planned payment retry at a better time, or through a second acquirer using cascading, recovers part of the lost volume. Card networks limit how many times a declined transaction may be retried and charge fees for excessive attempts, so retry logic has to respect the decline code. Correctly flagging transactions as customer-initiated or merchant-initiated, and sending complete data, also helps.

A high authorization rate is not a goal in itself. A merchant can raise the figure by blocking more risky traffic before it reaches the issuer, which removes likely declines from the count but also turns away good customers. In the other direction, loosening fraud controls may raise approvals while increasing chargebacks. An attack by fraudsters running card testing can drag the rate down sharply without reflecting any change in real customers. For subscription businesses, low approval on renewals shows up as involuntary churn. The rate is therefore read together with conversion, fraud and dispute measures.