Skip to content
Decline code 1A Meaning varies by network

Strong Customer Authentication Required

Category: Authentication Required (3DS/SCA) Retryable: yes

Variability

Meaning varies by network

Take the card brand and processor into account before treating this as diagnostic.

Retryable

yes

Retry the same transaction through a 3DS2 authentication flow — a plain resubmission without authentication will decline again with the same code.

Namespace: Legacy/conventional ISO 8583 field-39 code as implemented by card networks and processors — not the current ISO 8583:2023 Annex D table.

What this code typically means

A soft decline specific to PSD2's Strong Customer Authentication mandate in the EEA (adopted in similar form by some other regulators): the issuer is declining an unauthenticated attempt not because the transaction itself is bad, but because it must be re-presented with 3-D Secure 2 authentication before it can be approved. This is a regional code, not a universal one — but Stripe's authentication_required decline code and Adyen's refusal reason 38 ('Authentication required' — 'The issuer declined the authentication exemption request and requires authentication') both describe the identical mechanism, giving this code unusually strong, exact corroboration for a code in this set despite its narrow geographic scope.

What to do about it

Merchant action

Route the retry through your 3DS2/SCA flow rather than a standard resubmission; most checkout SDKs trigger this automatically on receipt of this decline.

Customer-facing guidance

Prompt the customer to complete the authentication challenge (OTP, banking app approval, biometric) from their issuer.

What's happening on the issuer's side

Declining pending authentication, per PSD2/RTS requirements or the issuer's own risk-based exemption logic.

Cross-processor equivalents

adyen: 38 — Authentication required

commonly treated as equivalent — near-exact match in Adyen's own wording

stripe: authentication_required

commonly treated as equivalent

Cross-processor mappings are commonly treated as equivalent, not identical — every processor's own documentation notes lossy or partial mapping between raw network codes and its own vocabulary.

Confidence: high. Status: convention. This code is widely used across card networks and processors but is not traceable to a single fetchable authoritative standard document — the current ISO 8583:2023 standard uses a different (4-digit) code scheme entirely. This entry is cross-verified against Stripe, Adyen, and/or a dated processor implementation; see sources below.

Sources

Concept + retry philosophy

Decline Codes: why they're opaque and how to retry them