Skip to content
Card Networks ← All terms

Decline Codes

Definition

Decline codes are the issuer's response codes indicating why a transaction was rejected and whether a retry is appropriate — meaning varies by network, and some are deliberate catch-alls.

Decline codes are response codes returned by a card issuer when an authorization request is rejected, indicating the reason for the decline. The familiar 2-digit codes (05 Do Not Honour, 51 Insufficient Funds, 14 Invalid Card Number, and so on) are a legacy convention still used by card networks and processors — not the current ISO 8583:2023 standard, which uses a different 4-digit action-code scheme. Decline codes determine whether a transaction should be retried (soft decline) or abandoned (hard decline), and what action the merchant should take. Meaning varies by network, and some codes — 05 chief among them — are deliberate issuer catch-alls rather than real answers. Correct handling of decline codes is a primary driver of authorization rate optimization.

Every declined authorization returns a response code alongside the decline. These codes are the issuer's signal to the merchant about what happened and what to do next. Acting on them correctly — retrying retryable declines at the right time, abandoning hard declines, requesting authentication where required — is the operational core of authorization rate management.

For a specific code's meaning, variability, and operator action, use the Card Decline-Code Lookup tool — it's the canonical per-code reference and covers 16 cross-source-corroborated codes with sourcing per entry. This page covers the concept: why the codes are structured the way they are, how opaque some of them deliberately are, and how to build a retry philosophy around that opacity.

These are not current ISO 8583 codes

The 2-digit codes merchants see day to day (05, 51, 54, 57, and the rest) are not part of the current ISO 8583:2023 standard. The live standard's Annex D defines a 4-digit action-code scheme for bit 39 — 00000999 for approved responses, 10001999 for denied responses, and so on. The 2-digit codes are a carryover from the 1987 and 1993 editions of ISO 8583, kept alive in practice because card networks and processors never migrated their own implementations off it. When you see "ISO 8583 decline code" used to describe 05 or 51, treat it as industry shorthand for a legacy convention, not a citation to a live standard document.

Quick reference: the 16 codes worth knowing

Exact-code lookup demand is thin, and concentrated on a handful of codes — most people asking about decline codes want the concept, not a specific number. These are the codes with enough cross-source evidence (PaymentBrief's own research, Stripe's decline-codes documentation, and Adyen's refusal-reason documentation) to write up honestly. For full detail — typical meaning, variability, retryability, and sourced operator/customer/issuer guidance — use the lookup tool.

CodeCategory
04Lost/Stolen (Pickup)
05Do Not Honor
07Suspected Fraud
14Invalid Account/Card Data
41Lost/Stolen (Pickup)
43Lost/Stolen (Pickup)
51Insufficient Funds
54Expired Card
57Restricted/Blocked Card
61Velocity/Limit Exceeded
62Restricted/Blocked Card
65Velocity/Limit Exceeded
75Restricted/Blocked Card
91Issuer Unavailable/Technical Error
96Issuer Unavailable/Technical Error
1AAuthentication Required (3DS/SCA)

Retry Strategy by Code

Blindly retrying every declined transaction wastes processing fees and degrades your merchant profile with issuers. Scheme rules also prohibit excessive retries:

Visa retry rules: the Visa Core Rules (Table 7-2) sort decline codes into four categories. Category 1 codes — where the issuer will never approve — must never be resubmitted for the same payment credential; the other three categories permit reattempts up to 20 attempts in 30 days. Secondary sources commonly give the cap as 15; the operative rule says 20. See Visa's four decline categories for the code lists, and confirm fee amounts with your acquirer — they are not in the Core Rules.

Mastercard retry rules: Mastercard publishes similar retry restrictions. Excessive retries on hard-decline codes can trigger scheme fines — verify current thresholds with your acquirer.

The correct approach is a decline-code-specific retry matrix: some codes retry immediately (technical errors), some retry after 24–48 hours (balance/limit issues), some retry after 7 days (generic do-not-honour), and some are never retried. See the Authorization Optimization article for the full retry-matrix and network-tokenization playbook.

Decline Code Opacity

In practice, issuers sometimes return generic codes — particularly 05 Do Not Honour — even when the underlying reason is more specific, partly to avoid giving fraudsters information about why a card was declined. Adyen's own refusal-reason documentation effectively concedes the same point: it maintains a dedicated catch-all bucket for responses that "cannot be reliably mapped" to anything more specific. This means the same code can represent very different underlying situations, and retry strategies need to account for that ambiguity rather than treat the label as a diagnosis.

PSPs with large transaction volumes can build decline-code-to-outcome models based on their own retry success data, producing better timing recommendations than generic scheme guidance alone.

Soft vs. hard declines

Whether a code is worth retrying at all — and the concept split between "will resolve on its own" and "will never resolve" — is covered in depth in Soft Decline.

Related terms