The short answer
Every authorization either approves (response code 00) or declines with a reason. Reason codes come from ISO 8583 (the card-network message format) and most processors add extra context on top. The single most valuable thing operators can do with declines is classify them into three buckets: soft (retry safely), hard (never retry), and fraud (never retry, probably block the customer).
Soft declines — retry logic is appropriate
- 05 — Do Not Honor. Frustratingly generic; issuer just said no. Retry with card-updater refresh or 3DS.
- 51 — Insufficient Funds. Retry in 2-5 days when paycheck likely hit.
- 61 — Exceeds Withdrawal Limit. Retry tomorrow.
- 65 — Activity Limit Exceeded. Retry tomorrow or split the charge smaller.
- 91 — Issuer Unavailable. Issuer bank was down. Retry in 15 minutes.
- 96 — System Malfunction. Network blip. Retry immediately.
Hard declines — stop retrying, contact the customer
- 04 — Pick Up Card. Issuer wants the card retained. Stop.
- 14 — Invalid Card Number. Typo or stale token. Stop and request new card.
- 15 — No Such Issuer. Card BIN does not route to any bank. Stop.
- 41 — Lost Card. Customer reported it lost.
- 43 — Stolen Card. Customer reported it stolen. Report in your fraud flow.
- 54 — Expired Card. Request fresh credentials or use account updater.
- 57 — Transaction Not Permitted to Cardholder. The card product can't be used here (prepaid corporate card at a consumer merchant, for example).
Fraud signals — block the customer
- 59 — Suspected Fraud. Issuer flagged this specific transaction.
- 62 — Restricted Card. Issuer has placed limits.
- 63 — Security Violation. CVV / expiry mismatch — look for card testing.
- R0/R1 — Stop Payment / Revocation of Authorization. Recurring charge killed by cardholder.
What operators need to know
- Visa's retry cap. Visa caps retries at 15 per 30 days per card on soft declines, four on hard. Exceed and each retry counts against your VAMP transaction integrity ratio.
- Don't retry hard declines. Each 14/15/54 retry drags your approval rate and signals risk to the issuer. Kill them at your gateway.
- Surface the code to the customer. "Card declined — contact your bank" does nothing. "Card expired — please update payment method" actually gets the card replaced.
- Track by BIN. If one issuing BIN shows 80% decline rate while peers show 30%, that BIN has flagged your MCC or descriptor. Often fixable.