Decline Codes

Every declined authorization returns a two-digit (or two-character) response code alongside the decline. These codes are the issuer's signal to the merchant about what happened and what to do next. Acting on them correctly — retrying retryable declines at the right time, abandoning hard declines, requesting authentication where required — is the operational core of authorization rate management.

Common Decline Codes Reference

Soft Declines (potentially retryable)

Hard Declines (do not retry)

CVV/AVS Result Codes

Retry Strategy by Code

Blindly retrying every declined transaction wastes processing fees and degrades your merchant profile with issuers. Scheme rules also prohibit excessive retries:

Visa retry rules: Visa publishes retry limits — commonly cited as a maximum of 15 attempts per transaction, with 1 retry per 24 hours for specific decline codes. The exact code list and thresholds are defined in the Visa Core Rules; verify current limits with your acquirer or PSP, as scheme rules can be updated.

Mastercard retry rules: Mastercard publishes similar retry restrictions. Excessive retries on hard-decline codes can trigger scheme fines — verify current thresholds with your acquirer.

The correct approach is a decline-code-specific retry matrix: some codes retry immediately (technical errors), some retry after 24–48 hours (balance/limit issues), some retry after 7 days (generic do-not-honour), and some are never retried.

Decline Code Opacity

In practice, issuers sometimes return generic codes (particularly 05 Do Not Honour) even when the underlying reason is more specific — to avoid giving fraudsters information about why a card was declined. This means the same code can represent very different underlying situations, and retry strategies need to account for this ambiguity.

PSPs with large transaction volumes can build decline-code-to-outcome models based on their own retry success data, producing better timing recommendations than generic scheme guidance alone.