Payment Decline Codes Explained: What They Mean and How to Fix Them

Updated September 2026.

What Are Payment Decline Codes?

When a card payment is declined, the issuing bank returns a two-digit response code that tells the payment processor — and ultimately the merchant — why the transaction was rejected. These codes follow standards set by card networks (Visa, Mastercard, Amex) and are consistent across most payment processors, though the exact descriptions vary slightly by acquirer.

Understanding decline codes matters for two reasons: they help you identify whether a decline is recoverable (retry logic) or hard (do not retry), and they surface patterns in your authorization data that point to systematic issues you can fix.

Soft Decline vs Hard Decline: Which to Retry

Before diving into specific codes, the most important distinction is between hard declines and soft declines.

Hard declines mean the transaction cannot be retried with the same card. The card is stolen, blocked, or invalid. Retrying will only generate more declines and risk flagging your merchant account for unusual activity.

Soft declines are temporary. Insufficient funds, a bank system timeout, velocity limits — these may succeed if retried at a different time, through a different processor, or with updated card credentials.

The Most Common Payment Decline Codes

Code 05 — Do Not Honor

The most common decline code. The issuing bank has declined the transaction without specifying a reason. This is a catch-all soft decline — the bank’s fraud model has flagged something about the transaction, but they won’t say what.

What it means in practice: This often fires when the transaction looks unusual relative to the cardholder’s history — wrong geography, unusual amount, new merchant category. It is not necessarily fraud.

What to do: Retry once with updated billing address data if available. Consider routing to a different acquirer. Implement network tokenization — transactions with network tokens have lower Do Not Honor rates because banks trust them more.

Code 14 — Invalid Card Number

The card number fails the Luhn check or does not match any record at the issuer. Usually a typo at checkout or an expired card that has been re-issued with a new number.

What to do: Prompt the customer to re-enter card details. If this code appears at high rates in your data, check your checkout form validation — a broken card number field can silently corrupt input.

Code 51 — Insufficient Funds / Exceeds Credit Limit

The cardholder’s account does not have sufficient funds or the transaction would exceed their credit limit. A soft decline.

What to do: Do not retry immediately — the funds situation has not changed. For subscription merchants, retry on a schedule (typically 3, 5, or 7 days later). Offer the customer alternative payment methods at the point of failure.

Code 54 — Expired Card

The card’s expiry date has passed. One of the most preventable declines.

What to do: Implement Account Updater or Real-Time Account Updates (RTAU) via Visa/Mastercard. These services automatically push new card credentials to merchants when a card is re-issued. For subscription businesses, this alone can recover 1–2% of revenue. Network tokenization provides the same benefit — tokens automatically update when the underlying card changes.

Code 41 — Lost Card / Code 43 — Stolen Card

Hard declines. The cardholder has reported the card lost or stolen. Do not retry.

What to do: Cancel any pending orders associated with this payment. Flag the customer account for review if there are other recent transactions. Do not attempt any further charges.

Code 61 — Exceeds Withdrawal Limit

The transaction exceeds a velocity or daily limit set by the issuing bank. Soft decline.

What to do: Retry later in the billing cycle. For large transactions, consider offering installment payment options (BNPL) as an alternative.

Code 65 — Exceeds Withdrawal Frequency

Too many transactions in a given time window. The issuer has hit a velocity threshold. Soft decline.

What to do: Common in subscription and autoship models where multiple retries are attempted in rapid succession. Space out retries — a 24-hour gap between attempts is the minimum. Batch retries can actually compound this problem.

Code 91 — Issuer Unavailable

The issuing bank’s system was offline or unreachable at the time of the transaction. A soft decline caused by technical failure on the bank’s side.

What to do: Retry after a short interval (30–60 minutes). Route through a different acquirer — some processors have direct connections to major issuers that provide better availability. This is where payment orchestration with failover adds real value.

Code 96 — System Malfunction

A generic technical error. Could be the acquiring bank, the card network, or the issuing bank. Almost always a soft decline.

What to do: Retry once. If it persists, route through a backup processor.

Code R0 / R1 / R3 — Recurring Payment Stop

The cardholder has instructed their bank to stop recurring charges from this merchant. This is common in subscription businesses.

What to do: Stop retrying immediately. Send the customer a communication about their subscription status. Do not interpret this as a temporary failure — it is an explicit instruction from the cardholder’s bank.

Complete Card Decline Code List (Visa and Mastercard)

Visa and Mastercard both use two-character response codes based on the ISO 8583 standard, so most codes mean the same thing across networks and processors. The table below covers the codes you will see most often in production, including debit card declines. “Soft” means the condition may clear; “hard” means the same card will not be approved; “data” means the customer needs to fix what they entered.

Visa and Mastercard Retry Rules

Retrying declines is not a free-for-all. Both networks publish rules on when you may reattempt a declined transaction, and both charge fees for breaking them.

Visa decline categories

Visa groups response codes into four categories:

• Category 1 — Issuer will never approve: the card is invalid, closed, lost, or stolen (for example 04, 07, 14, 15, 41, 43, 46, R0, R1). Do not retry. Visa charges a fee on every reattempt.
• Category 2 — Issuer cannot approve at this time: temporary conditions such as insufficient funds or velocity limits (for example 51, 61, 65, 91, 96).

  Retries are allowed, up to 15 times in 30 days.

• Category 3 — Data quality: something in the request was wrong, such as the CVV or expiry date. Fix the data before retrying; the same 15-in-30-days cap applies.
• Category 4 — Generic codes: everything else, including 05. Treat these conservatively and stay within the same limits.

Visa’s excessive reattempt fee is $0.10 per attempt for domestic transactions and $0.15 for cross-border. Visa updates its category assignments periodically, so check your processor’s current mapping rather than hard-coding one.

Mastercard Merchant Advice Codes (MAC)

Mastercard adds a Merchant Advice Code to many declines. It tells you what to do next, which is often more useful than the response code itself:

Under its Transaction Processing Excellence program, Mastercard charges fees for retrying after MAC 03 or 21 and for excessive authorization attempts on the same card. Amounts vary by region, so ask your acquirer for the schedule that applies to you.

Decoding Processor Decline Messages

Processors and gateways often show their own text instead of the raw code. A few common ones:

• “EXC W/D FREQ LIM”: exceeds withdrawal frequency limit, response code 65. The card hit an issuer velocity limit. Authenticate with 3DS or retry later.
• “Processor declined”: a generic message from the gateway. Look up the underlying issuer response code in your processor’s dashboard or API response before deciding whether to retry.
• “Generic decline” / “Do not honor”: usually code 05.

  Soft decline; retry within network limits.

• Messages mentioning “risk” or “risk parameters”: usually a decline from your processor’s or gateway’s own risk rules, not from the issuing bank. Check your fraud or risk settings; retrying unchanged will fail the same way.
• “Pick up card”: codes 04 or 07. Hard decline; never retry.

Decline Codes by Recovery Strategy

Retry immediately (different processor): 91, 96

Retry later (same processor): 51, 61, 65

Retry with updated credentials: 14, 54 — use Account Updater or network tokenization

Do not retry: 41, 43, R0, R1, R3

Retry once with additional data: 05 — consider adding 3DS authentication or routing to an acquirer with a strong relationship to that issuer

How to Reduce Payment Declines Using Decline Codes

Decline code analysis is one of the most underutilized levers in payments product management. Most teams track overall authorization rate, but few drill into the composition of their decline mix.

If code 54 (expired card) represents a disproportionate share of your declines, you have a card updater gap. If code 05 (Do Not Honor) is elevated, your transaction signals may be triggering bank fraud models — transaction labeling improvements or network tokenization can help. If code 65 (velocity) is high, your retry logic is too aggressive.

Build a dashboard that tracks decline codes as a percentage of total attempted transactions, and monitor trends weekly. A shift in the mix often signals a change upstream — a processor configuration change, a new card type in your customer base, or a fraud model update at a major issuer.

Decline Codes: Key Takeaways

• Decline codes tell you why an issuer rejected a payment and whether a retry can work.
• Soft decline codes can be retried with the right timing; hard decline codes should not be retried.
• Code 05 (Do Not Honor) is the most common, and reading it alongside other decline codes shows the real cause.
• Group decline codes by recovery strategy: retry now, retry later, update credentials or stop.

Frequently Asked Questions

What is the most common payment decline code? Code 05 (Do Not Honor) is the most common. It is a soft decline from the issuing bank that does not specify the reason for refusal.

What is the difference between a hard and soft decline? A hard decline (e.g. stolen card) cannot be retried — the card is blocked. A soft decline (e.g. insufficient funds, technical timeout) may succeed if retried at the right time or through a different processor.

Can network tokenization reduce declines? Yes. Network tokens are tied to the card account rather than the physical card number, so they automatically update when a card is re-issued. This eliminates most code 54 (expired card) declines and reduces code 05 (Do Not Honor) rates because issuers trust tokenized transactions more.

How many times can I retry a declined card payment? Visa allows up to 15 reattempts in 30 days for declines that are not Category 1, and none for Category 1 codes such as lost, stolen, or closed accounts. Mastercard prohibits retries after Merchant Advice Code 03 or 21 and charges fees for excessive attempts. Space retries out rather than retrying immediately.

What does “EXC W/D FREQ LIM” mean on a declined card? It means “exceeds withdrawal frequency limit,” response code 65. The card has hit the issuer’s limit on the number of transactions in a period. The customer can wait, confirm the purchase with their bank, or complete 3D Secure authentication.

What is a merchant advice code? A code Mastercard sends with many declines that tells the merchant what to do next: update the card details (01), try again later (02), stop retrying (03), or retry after a specific interval (24–30).

What does a “processor declined” message mean? It is a generic message from the payment gateway, not a specific reason. Check the underlying issuer response code in your processor’s data to see whether the decline is soft or hard.

Related Reading

• Authorization Rate Optimization: A Payments PM’s Complete Guide
• Fraud Declines vs. No-Fraud Declines
• Why Merchants Should Adopt Network Tokenization
• What Is a Chargeback and How Can Merchants Prevent It?
• Subscription Payment Retry Logic and Dunning Management: A Payments PM’s Guide
• Transaction Labeling in Payments: How Descriptor Optimization Improves Authorization Rates
• Tokenisation vs Encryption in Payments: What’s the Difference?
• Payments Product Manager Interview Questions: What to Expect and How to Answer