The report says «declined» and gives you a code. The customer says the card works everywhere else. Somewhere between those two sentences is money you did not collect. The code is the only clue you have.
Card decline codes are less mysterious than they look. Only a few things can go wrong. Each of them belongs to someone specific: the customer’s bank, the card scheme, your gateway or your own checkout. As a result, knowing who holds the payment tells you what to do. You retry, ask the customer for something, or change a setting on your side.
Who actually says no
A card payment passes through three parties before it succeeds. The issuer is the bank that gave the customer the card and holds the money; it makes the final decision. Next, the card scheme carries the request and enforces its own rules. Finally, the acquirer is the side that serves you, the merchant, and settles the funds.
Almost every decline you will ever see comes from the issuer. That matters. Most declines are not something your provider can override. However, they are something your checkout can influence. How the request is routed and retried is described under payment processing.
Soft and hard: the only split that changes your behaviour
A soft decline is temporary. Not enough funds, a limit reached for the day, a bank system unavailable, an authentication step the customer did not finish. The same card may well work in an hour. Retrying is allowed and sensible.
A hard decline is final. The card is closed, reported lost or stolen, the account no longer exists. Retrying a hard decline achieves nothing. In fact, repeated often enough, it becomes a signal that gets your traffic looked at.
Therefore, if your reporting does not separate the two, that is the first thing to fix. Every decision below depends on it.
The five groups you will actually see
- No money. Insufficient funds or a limit hit. The most common decline in every portfolio. Soft: retry later, and consider offering a smaller plan or a second payment method.
- Authentication not completed. The customer opened the bank confirmation and abandoned it, or the flow broke on mobile. Soft, and usually a checkout problem rather than a bank problem.
- Card invalid or closed. Wrong expiry, wrong security code, card cancelled. Hard for the closed ones — ask for a different card rather than retrying.
- Suspected fraud. The issuer’s own model refused it. You will not be told why. Repeat attempts on the same card make it worse.
- Restriction on the transaction. The card is not allowed for this type of purchase, this currency or this country of the merchant. Hard for that card, and worth reading as a signal about your customer mix.
Numeric codes differ between card schemes and are published by them. So read the group first and the number second. Why the higher-risk categories see more of all five is set out in our piece on what makes a business high-risk.
What to fix on your side
Retry with a schedule, not a loop. For example, soft declines retried after hours or days recover a real share of revenue. The same decline hammered five times in a minute recovers nothing and looks like card testing.
Check the currency and the descriptor. A charge in an unexpected currency, or from a name the customer does not recognise, is refused by the customer as often as by the bank.
Do not silently fail. Tell the customer what happened in plain words and offer a second route immediately. Most abandoned payments are abandoned at the error screen, not at the price.
Watch the approval rate as a number, not a feeling. How routing across several routes lifts it is explained in our piece on payment cascading and orchestration.
When declines are not the real problem
A rising decline rate sometimes means the acceptance setup no longer fits the business — wrong routes, a single acquirer, no fallback. That is a different conversation from tuning retries, and it is covered in our piece on why traditional payment gateways do not work for high-risk businesses.
Watch the two numbers together. Approval rate and dispute ratio move against each other. For instance, filters that push declines down push disputes up. A filter tightened to protect one usually costs more on the other. What each line of acceptance costs is on the pricing page.
What to log so the next month is easier
Most merchants store the decline and nothing around it. As a result, the report becomes a list of complaints rather than a tool. Four fields turn it into one.
- Soft or hard, recorded at the moment of the decline. This is what decides whether a retry is allowed at all.
- Attempt number for that card. The second attempt behaves differently from the fifth, and the fifth is what gets your traffic noticed.
- The step where it happened. Authorisation, authentication or your own validation. A surprising share of «bank declines» never reached a bank.
- Whether the customer came back. A recovered payment is the only proof a retry policy works.
In short
Card decline codes point at four possible owners, and almost always at the issuer. Split soft from hard, and retry only the soft ones on a schedule. Also fix the currency and the descriptor. Never leave the customer at an error screen without a second route. Then measure approval rate weekly. In the end, it decides how much of your traffic turns into money on your merchant account.