Card Decline Codes Explained: Soft vs. Hard and Retry Rules

Last updated: November 5, 2026

A boutique fitness studio runs 2,300 monthly memberships on the first of each month. Every month, about 180 fail. The billing system retries all of them every day for a week, the same way, regardless of why they failed. Some recover. Many don’t. And a handful of those cards were reported stolen, which means the studio has been retrying cards it should never have touched again.

Card decline codes are the issuer’s short answer to “why not?” Read properly, they tell you which payments to retry, when to retry them, which customers to contact, and which cards to drop for good. Ignored, they cost you recoverable revenue and, under current card network rules, fees for excessive retries.

This guide covers the most common decline codes in a reference table, the difference between soft and hard declines, Visa and Mastercard retry rules (with the figures we could verify, and where sources disagree), and practical ways to cut false declines. We’ll also be straight about what a payment CRM like Midcove does here and what it doesn’t.

Card decline codes are two-character response codes, mostly based on the ISO 8583 standard, that the card issuer returns when it refuses an authorization. They separate soft declines, which may succeed on retry, from hard declines, which won’t. Merchants use them to decide whether to retry, ask for a new card, or stop.

How Card Decline Codes Work

When you submit a card payment, the request travels from your gateway to your processor, through the card network, to the issuing bank. The issuer checks funds, fraud signals, card status, and its own rules, then responds. “00” means approved. Anything else is a decline or a referral, with a code explaining why.

Most of these codes trace back to ISO 8583, the message standard card networks use. But networks, processors, and gateways all add their own layers. Visa has codes like N7 for a CVV2 mismatch. Mastercard adds merchant advice codes (MACs) alongside the main response. Gateways often translate everything into their own reason codes or text.

Why the same decline looks different in each gateway

Stripe shows decline codes as words like insufficient_funds or do_not_honor, documented in its decline code reference. Authorize.Net returns numbered response reason codes, listed in its response code reference. NMI and PayPal have their own formats too. If you run more than one gateway, map them back to a common set before you build any rules.

Issuers don’t always tell the whole truth

Issuers often use a generic code on purpose. “05 Do not honor” can mean suspected fraud, a velocity rule, a blocked merchant category, or simply “no.” Banks avoid giving fraudsters detailed feedback. So treat generic codes as uncertain, not as a final verdict.

Common Card Decline Codes Table

This table covers the codes you’ll see most. Meanings follow common ISO 8583 usage; check your processor’s documentation for its exact wording.

Soft vs. Hard Declines

The single most useful split in decline handling is soft vs. hard.

Soft declines

A soft decline means “not now.” The card is valid, but something temporary got in the way: low funds, a daily limit, an issuer outage, or a fraud rule that a quick call to the bank could clear. Soft declines are worth retrying, with sensible timing and limits.

Hard declines

A hard decline means “not this card, not ever.” The card is closed, lost, stolen, invalid, or the issuer has decided it won’t approve your transaction type. Retrying a hard decline won’t work, annoys the issuer, and can trigger network fees. The right move is to ask the customer for a different payment method.

The gray zone

Some codes sit in between. “05 Do not honor” is technically soft but often behaves like a hard decline for that merchant. “54 Expired card” is hard for the old expiry date but fixable once you have the new one. Your rules should allow for one cautious retry on gray-zone codes, then switch to customer contact.

Card Brand Retry Rules

Both Visa and Mastercard now penalize merchants who keep retrying declined cards. The rules are aimed mainly at card-not-present transactions and at reattempts on the same card. We verified the figures below against processor guidance; network rulebooks are the final word, so confirm the current numbers with your acquirer.

Visa

Visa groups decline codes into four categories:

• Category 1, issuer will never approve: codes such as 04, 07, 12, 14, 15, 41, 43, 46, 57, R0, R1, and R3. Do not reattempt with the same card details. Any reattempt can draw a fee.
• Category 2, issuer can’t approve at this time: codes such as 51, 61, 65, 91, and 96. Reattempts are allowed within a cap.
• Category 3, data quality: codes such as 54, 55, 70, 82, 1A, and N7. Fix the data before reattempting.
• Category 4, generic: all other codes.

For Categories 2 to 4, Visa caps reattempts on the same card within a 30-day window. PayPal’s guidance on excessive retries currently lists that cap as 20 reattempts in 30 days, with fees on each attempt beyond it. Earlier industry summaries cited 15, so check the current figure with your acquirer.

Mastercard

Mastercard’s approach uses limits plus merchant advice codes (MACs) that come back with the decline:

• Processor guidance cites a limit of 10 retries on the same card within 24 hours and 35 within 30 days, with fees beyond those caps.
• MAC 03 (do not try again) and MAC 21 (payment cancelled) mean stop. Retrying after these can draw a fee.
• MAC 01 means new account information is available. Get it, typically through an account updater, before retrying.
• MAC 24 to 30 tell you when to retry after an insufficient funds decline, ranging from one hour to ten days.

Fee amounts vary by region and change over time, so we haven’t listed them here. The principle doesn’t change: stop retrying hard declines, and retry soft ones with a plan.

Building a Retry Strategy

Here’s a simple, rule-friendly retry plan for recurring or card-on-file payments. Adjust the timing to your customers’ pay cycles.

1. Map every gateway’s codes to one list. Group them as hard, soft, data issue, or fraud signal.
2. Stop on hard declines. Flag the account, notify the customer, and request a new card. Never retry lost, stolen, or pick-up codes.
3. Fix data declines first. For expired cards or CVV mismatches, get updated details before any retry.
4. Space out soft retries. Retry insufficient funds after 3 days, then 7 days, rather than daily. Follow Mastercard MAC timing when present.
5. Cap retries well below network limits. Four attempts over two weeks recovers most recoverable payments without getting near any cap.
6. Email or text the customer early. A “your payment didn’t go through” message with an update link often beats another retry.
7. Measure recovery by code. Track which codes recover on retry and which never do, then adjust.

The fitness studio from our opening rebuilt its billing this way. It stopped retrying hard declines on day one, spaced out retries on code 51, and sent update-card emails after the first failure. Recovered revenue went up, and it stopped racking up attempts on cards reported lost or stolen.

Where Midcove fits, and where it doesn’t

To be clear, Midcove doesn’t run automatic or “smart” retries, and it doesn’t route a declined payment to a different gateway. Retry logic lives in your billing system or your gateway’s own recurring tools, such as Authorize.Net’s recurring billing or Stripe Billing. What it does is show decline reasons for every transaction across NMI, Authorize.Net, Stripe, and PayPal in one transaction management dashboard, and report approval rates per MID so you can see which codes are rising and where. If you need automated retries and routing, that’s the job of a payment orchestration platform.

How to Reduce False Declines

Not every decline is about the card. Many are issuers being cautious about a transaction that looks unusual. These steps reduce that caution.

Keep card data fresh

Account updater services from Visa and Mastercard supply new card numbers and expiry dates when cards are reissued. Network tokens update automatically in a similar way. Both cut expired-card and closed-account declines on stored cards.

Send complete, consistent data

• Include billing ZIP and CVV on customer-initiated payments.
• Flag stored-credential and recurring transactions correctly, so issuers know the customer agreed to them.
• Use a clear billing descriptor that customers and issuers recognize.

Handle authentication in Europe

Under strong customer authentication rules in Europe, issuers can soft-decline a payment and ask for authentication. Visa signals this with 1A, and Mastercard commonly with 65. The fix is to send the customer through 3-D Secure and try again, not to retry blindly.

Watch for patterns, not single declines

A sudden rise in one code on one MID tells you more than any single decline. If “do not honor” doubles on one account, look at what changed: a new product, a new descriptor, a fraud rule, or a card testing attack. Our post on card testing attacks covers how bot traffic distorts decline data, and our guide to payment reporting KPIs shows how to track decline mix over time.

Keep a second MID ready

Some declines come from issuer caution about a specific merchant account or its category. Having another merchant account available lets you move a product line manually if one MID’s approvals drop for reasons you can’t fix quickly. With multi-gateway processing in a payment CRM, you can run several MIDs side by side and choose one manually for each payment.

Key Takeaways

• Card decline codes mostly follow ISO 8583, but each gateway displays them differently, so map them to one shared list.
• Soft declines (51, 61, 91, 96) can be retried with spacing; hard declines (04, 14, 41, 43, 57) should never be retried.
• Visa caps reattempts on retryable declines over 30 days and bans reattempts on Category 1 codes; confirm the current cap with your acquirer.
• Mastercard limits retries to 10 in 24 hours and 35 in 30 days, and MAC 03 or 21 means stop.
• Fix data declines (expired card, CVV mismatch) before retrying, and use account updater to keep stored cards current.
• Track decline mix per MID; a rising code on one account is a signal worth investigating.

Frequently Asked Questions

What does decline code 05 mean?

Code 05 means “do not honor.” It’s a generic decline where the issuer refuses the transaction without giving a specific reason. It can reflect suspected fraud, an issuer rule, or a restriction on the card. Retry once later at most; if it repeats, ask the customer to contact their bank or use another card.

What is the difference between a soft decline and a hard decline?

A soft decline is temporary, such as insufficient funds or an issuer outage, and may succeed on a later retry. A hard decline is permanent for that card, such as a lost, stolen, closed, or invalid card. Retry soft declines with spacing and limits; never retry hard declines.

Can I retry a declined card payment?

Yes, for soft declines, but within limits. Visa and Mastercard both cap how often you can reattempt the same card and charge fees for excessive retries. Never retry codes like lost, stolen, or pick up card. Space retries out over days rather than hours.

What does decline code 51 mean?

Code 51 means insufficient funds. The card is valid, but the account doesn’t have enough available balance or credit for the amount. It’s a soft decline, so retrying after a few days, ideally near a typical payday, often succeeds. Mastercard may include a merchant advice code that suggests when to retry.

How many times can you retry a declined card?

It depends on the network and the code. Mastercard guidance cites 10 retries in 24 hours and 35 in 30 days. Visa caps reattempts on retryable codes within 30 days and bans them on Category 1 codes. Most merchants should stay far below these limits, around three to four retries.

Why is my card being declined when I have money?

Issuers decline for reasons beyond balance: suspected fraud, unusual location or merchant type, daily limits, an expired or reissued card, wrong CVV or ZIP, or an authentication request. The cardholder’s bank can usually tell them the exact reason and clear the block.

What does a merchant advice code mean?

A merchant advice code (MAC) is extra guidance Mastercard returns with some declines. It tells the merchant what to do next: get updated account information (01), try later (02), stop retrying (03), or retry after a specific delay (24 to 30). Following MACs helps avoid retry fees.

How do I reduce false declines?

Send complete data (CVV, billing ZIP, correct recurring flags), use account updater or network tokens for stored cards, keep a clear billing descriptor, and use 3-D Secure where issuers ask for authentication. Also monitor decline codes per MID so you can spot and fix new patterns quickly.

Reading the Issuer’s Answer

Card decline codes are the most direct feedback you get from issuers, and most merchants waste it. Map every gateway’s codes to one list. Stop on hard declines, fix data problems before retrying, and space out soft retries well inside Visa and Mastercard limits. Then watch the decline mix per merchant account, because a rising code usually points to something you can fix.

Midcove won’t retry or reroute payments for you, but it does put decline reasons and approval rates from every NMI, Authorize.Net, Stripe, and PayPal account into one place, so your team can see what’s failing and act on it. Pair that visibility with retry logic in your billing system, and declines stop being a monthly mystery.