Payment Decline

A payment decline is a refusal of a payment request by the bank or provider that holds the payer's funds or credit, most often a card issuer responding to an authorization request. The decline is returned to the merchant as a response code that indicates, more or less precisely, why the payment was refused, such as insufficient funds, a suspected fraud, an expired card or a restriction on the account.

Declines are the most common kind of payment failure in card acceptance. They are decided by the issuing bank, sometimes by the network acting on the issuer's behalf, and occasionally by the merchant's own fraud screening before the request leaves its systems. Industry practice divides declines into "hard" declines, which will not succeed if repeated, and "soft" declines, which might succeed later or after a change, a split that drives payment retry rules.

Asking a card issuer to approve a payment is like asking a club bouncer to let someone in. The bouncer might say no because the person is not on the list, because the club is full tonight, because their ID has expired, or because something about them looks suspicious. Some of those reasons will still apply tomorrow; others might not.

A decline is the bouncer's "no". The shop gets a short code explaining the reason, though banks often give a vague one, like a bouncer saying "not tonight". The shop then has to decide whether to ask the customer for another card, ask them to call their bank, or try again later.

Card authorization messages follow the ISO 8583 standard, and the issuer's answer comes in a two-character response code. Widely used examples include:

• 05 – Do not honour. A generic refusal with no stated reason, the most frequent and least informative code.
• 51 – Insufficient funds. The account or credit line cannot cover the amount.
• 54 – Expired card. The expiry date has passed or does not match.
• 14 – Invalid card number. No such account exists at the issuer.
• 41 / 43 – Lost or stolen card. The card has been reported and must not be used.
• 57 – Transaction not permitted to cardholder. The card is not allowed for this type of purchase, for example blocked for online or foreign transactions.
• Authentication required. In Europe, issuers use specific codes (such as Visa's 1A and Mastercard's 65) to say the payment needs strong customer authentication.

Visa groups decline codes into four categories: category 1 means the issuer will never approve, categories 2 to 4 cover cases that might be approved later or after data is corrected. Mastercard adds Merchant Advice Codes, which tell merchants whether and when to retry, for example "do not try again" or "updated account information available". Processors and payment gateways often translate these into their own simplified codes, so merchants may not see the raw issuer response.

Beyond the cardholder's balance, issuers weigh fraud risk. Their models look at the merchant, the merchant category code, location, amount, device and recent behaviour, and decline transactions that look unusual; many are false positives, where a genuine customer is refused. Cross-border and card-not-present payments are declined more often than domestic in-store ones, which is one reason merchants use local acquiring. Missing or poor data, such as an absent CVV or a failed address check, also raises the chance of a decline. Payments authenticated through 3-D Secure give issuers more data and are generally approved more readily.

• Send complete data. Include CVV, billing address, and the correct indicators for recurring, stored-credential and merchant-initiated payments, which issuers treat differently.
• Keep credentials current. Network tokens and account-updater services replace expired or reissued card details automatically.
• Use clear descriptors. A recognisable billing descriptor and correct MCC help issuers trust the merchant.
• Route intelligently. Smart payment routing can send transactions through acquirers with better approval rates for a given country or card type.
• Respond correctly. Ask for another card on hard declines, prompt for authentication when SCA is requested, and retry soft declines only within network limits.

Declines protect cardholders and issuers from fraud, but every false decline costs the merchant a sale and can push the customer to a competitor. Fraudsters also use declines as information: in card testing fraud, bots submit many small authorizations to find which stolen card numbers are live, producing bursts of declines that merchants detect with velocity checking and bot defences. Excessive repeated attempts on declined cards are penalised by the networks, which charge fees for reattempts beyond set limits. For the customer, the best outcome is a clear message, such as "your bank declined this payment; please try another card or contact your bank", without revealing fraud-screening details that could help an attacker. Merchants measure the authorization (approval) rate as a key indicator of payment risk and checkout performance.

• Visa Core Rules and Visa Product and Service Rules
• EMVCo: EMV 3-D Secure