Every declined payment is lost revenue, and often a lost customer too. Some declines are right: the card is stolen or the account is empty. But many are avoidable, caused by poor data, the wrong retry pattern, a missing authentication step or a payment routed through the wrong acquirer.
This guide explains why card payments are declined, how to tell recoverable declines from final ones, how authorisations and pre-authorisations work, and what you can do to improve your approval rate, especially as a high-risk merchant.
Key takeaways
- Declines are either soft (temporary, often recoverable) or hard (final). Treating them the same wastes money and can break card scheme rules.
- Visa groups decline codes into categories. Codes in Category 1 must never be retried, and other declines may be retried no more than 15 times in 30 days.
- Most avoidable declines come from data quality, missing strong customer authentication, outdated card details or cross-border routing.
- Pre-authorisations and account verifications have strict rules on when they can be used and how long they last. Misusing them causes fees.
- The biggest levers are clean customer data, 3D Secure where needed, account updater services, local acquiring and smart, rule-compliant retries.
Why card payments are declined
Soft declines and hard declines
Soft declines are temporary. The issuer can’t approve the payment right now, for example because of insufficient funds, a spending limit, a suspected fraud flag or a request for extra authentication. These can often succeed later, or after a fix.
Hard declines are final. The card is lost, stolen or closed, the account doesn’t exist, or the issuer will never approve this transaction. Retrying them achieves nothing except fees and a worse standing with your acquirer and the card schemes.
Common decline codes
| Code | Meaning | What to do |
|---|---|---|
| 05 | Do not honour | Generic decline. Don’t hammer it with retries. Check for authentication or risk issues, or ask the customer to contact their bank. |
| 51 | Insufficient funds | Soft decline. Retry later within the scheme limits, or ask for another payment method. |
| 54 | Expired card | Ask the customer for updated details, or use an account updater service. |
| 14 | Invalid card number | Data problem. Ask the customer to re-enter the card. |
| 41, 43 | Lost card, stolen card | Hard decline. Never retry. |
| 1A (Visa, EEA and UK) | Additional authentication required | Retry with 3D Secure so the customer can authenticate. |
Codes and wording vary by card scheme and processor, so map your processor’s response codes to clear actions in your checkout and billing system.
Visa’s decline categories and retry limits
Visa groups its decline codes into categories that tell you whether a retry is allowed:
- Category 1, issuer will never approve: for example lost or stolen card, closed account or invalid account. Do not retry.
- Category 2, issuer can’t approve at this time: for example insufficient funds or a temporary restriction. Retrying is allowed.
- Category 3, data quality: for example expired card, invalid card number or wrong CVV. Correct the data before trying again.
- Category 4, generic: retrying is allowed.
Retries on the same transaction are limited to 15 within 30 days, and Visa charges fees for excessive reattempts and for retrying Category 1 declines. Mastercard has its own rules and merchant advice codes that tell you when not to retry. Your acquirer can tell you which fees apply to your account.
Authorisations and pre-authorisations
Not every authorisation is a final charge. Using the right type for each situation avoids declines, disputes and scheme fees.
Types of authorisation
- Final authorisation: for a known amount you will capture straight away, as in most online purchases.
- Estimated authorisation (pre-authorisation): a hold for an amount you can’t know exactly yet, for example a hotel stay or car rental. You capture the final amount later.
- Incremental authorisation: adds to an earlier estimated authorisation when the amount grows.
- Account verification: a zero-amount check that a card is valid, without holding funds. Use this to check a card, not a small test charge.
- Reversal: releases all or part of a hold you won’t capture.
Visa’s rules for estimated authorisations
Under Visa’s authorisation guidance, an estimated authorisation must be a genuine estimate, not an arbitrary amount, and the cardholder must be told that the amount is an estimate. It can’t be used for recurring payments, instalments or advance payments. The hold is valid for a limited time from approval: 30 days for lodging, vehicle rental and cruise lines, 10 days for other rental merchants and for cardholder-initiated card-absent payments, and 5 days for card-present payments. If a transaction won’t be completed, the authorisation should be reversed within 24 hours, and any excess should be reversed within 24 hours of completion.
Authorisations that are never matched to a capture or reversal, and small test charges used instead of account verification, can trigger Visa’s misuse of authorisation fees.
Using verification for subscriptions
For recurring billing, a zero-amount account verification at sign-up confirms the card is valid without charging the customer. Before renewals, account updater services from Visa and Mastercard, and network tokens, keep stored card details current so fewer renewals fail on expired or replaced cards.
How to prevent declines before they happen
Send complete, accurate data
Issuers approve what they can recognise. Send the full billing address, the customer’s email and phone where your processor supports it, and the correct merchant category code. Use a billing descriptor customers recognise. Validate card numbers and expiry dates in the checkout before you send the authorisation.
Handle strong customer authentication properly
In the EEA and the UK, most online card payments need strong customer authentication. Without it, issuers decline or ask for it with a soft decline. Use 3D Secure and apply the exemptions your acquirer supports for low-risk or low-value payments, so you authenticate where it is needed without adding friction everywhere.
Keep stored cards up to date
Account updater services and network tokens update stored card details automatically when a card is replaced or expires. That matters most for subscriptions, where expired cards are a common cause of failed renewals.
Tune your fraud rules
Fraud filters that are too strict decline good customers. Review what your rules block, test changes, and use 3D Secure for medium-risk payments instead of declining them outright. See our guide to fraud protection and prevention.
Process locally where you can
Issuers are more cautious with foreign merchants. Processing through an acquirer in the customer’s region, pricing in local currency and offering local payment methods all help. Our cross-border payments guide covers this in detail.
Smarter retries and routing
Retry only what can succeed
Map every decline code to an action: retry later, retry with authentication, ask for new details, or stop. Never retry hard declines, and stay within the scheme limits. For subscriptions, spread retries over several days instead of retrying at once.
Route to the acquirer most likely to approve
If you have more than one acquirer, sending each payment to the one that performs best for that card’s country, issuer or type can lift approvals. That is BIN routing, and payment orchestration automates it, including failover when one provider has problems.
Measure what matters
Track approval rates by card country, issuer, card type and payment method, and keep a breakdown of decline codes. A problem with one issuer or one country is easy to miss in a global average. Improving approvals by one percentage point on 1,000,000 EUR of attempted payments is 10,000 EUR more revenue.
Recovering declined payments
- Tell the customer clearly. “Your card has expired, please update it” works better than “Payment failed”.
- Offer another way to pay at the moment of decline, such as a second card or a local payment method.
- For subscriptions, send a short update-your-card reminder before you pause the account.
- Make updating payment details easy, with a direct link and no login hurdles.
Why high-risk merchants see more declines
Issuers apply stricter rules to merchant categories associated with fraud and disputes, such as adult, gambling and nutraceuticals. Some issuers block certain categories altogether, and some cardholders block them themselves. You can’t change your category, but you can make every payment as clean as possible: correct data, authentication where needed, a recognisable descriptor, and a provider with acquiring relationships that suit your industry.
Frequently asked questions
What is a good card approval rate?
It depends heavily on your industry, your customers’ countries and whether payments are domestic or cross-border. Compare your rate against your own history by market and card type rather than against a general benchmark.
What is the difference between a soft decline and a hard decline?
A soft decline is temporary and may succeed later or after a fix, such as authentication or new card details. A hard decline is final, for example a lost, stolen or closed card, and should never be retried.
How many times can I retry a declined card payment?
Under Visa’s rules, declines in Category 1 must never be retried, and other declines can be retried no more than 15 times in 30 days. Mastercard has its own rules. Excessive retries lead to scheme fees.
What is a pre-authorisation?
A pre-authorisation, or estimated authorisation, holds an estimated amount on a card when the final amount isn’t known yet, for example for a hotel stay. The merchant captures the final amount later and must release any unused part of the hold.
Can I use a small test charge to check a card?
No. Use a zero-amount account verification instead. Small test charges can trigger card scheme fees for misusing the authorisation system.
How does 3D Secure affect approval rates?
In the EEA and UK, issuers often decline online payments that need strong customer authentication but don’t have it. Using 3D Secure where it is required, and exemptions where they apply, avoids those declines.
Why are my payments declined more often from some countries?
Issuers are more cautious with foreign merchants. Local acquiring, local currency pricing and local payment methods usually improve approval rates in those markets.
Next step
Better approval rates start with the right acquiring setup for your industry and markets. Fasto works with adult, subscription, nutraceutical, gaming, dating and hospitality merchants. Approval typically takes two to three weeks.
Get a free quote and tell us where your declines come from.
Source: Visa: authorisation and reversal processing best practices for merchants.
