Where your good customers get declined, and why

When a card payment gets declined, the reason is rarely “the customer had no money”. A declined card payment is often a good customer, stopped somewhere in the payment chain — at checkout, the gateway, 3D Secure, or the issuer — for a reason you can fix. Soft declines can be recovered; hard declines should not be retried. Getting that split right is how you lift your card approval rate without touching your headline rate.

Why declined card payments cost more than your headline rate

Most businesses obsess over the rate on the statement. Fewer look at approval rate: the share of card attempts that actually go through.

Picture a shop where one in ten online attempts fails. That is an illustration, not a benchmark. But if those were real customers with money to spend, the lost sales dwarf a few basis points on the rate.

You do not need to become a payments engineer. You need to know where declines happen, which payment decline codes are recoverable, and what to ask your acquirer and gateway.

Soft decline vs hard decline

Treat every decline code as either recoverable or not. That is the soft decline vs hard decline split.

Soft declines mean “not this time, but try again the right way”. Common examples: insufficient funds, a temporary issuer or network blip, or the issuer asking for stronger authentication before they will approve. Retry rules matter here. Blindly hammering the same request can make things worse and, on some schemes, attract fees for too many failed attempts.

Hard declines mean “do not keep trying this card”. Lost or stolen cards, closed accounts, invalid details, fraud blocks, and cards that are not allowed for that type of purchase. Ask for another payment method. Do not keep submitting.

If your team cannot tell soft from hard in the reports you get today, that is the first gap to close.

Where in the chain card payments get declined

A card payment is not one system. It is a chain. The customer, your checkout, your payment gateway, your acquirer, the card schemes, and the customer's bank (the issuer) all get a say. We covered who does what in Payment gateway, acquirer, processor: who does what?. Declined card payments can start at more than one point.

1. At your checkout or gateway

Bad data, expired cards, AVS or CVV mismatches, timeouts, or a gateway rule that is too tight. These often look like “issuer declines” in a casual report, when the request never got a clean shot. Fix the data and the rules before you blame the bank.

2. At authentication (3D Secure declines / SCA)

In the UK, Strong Customer Authentication (SCA) applies to most electronic payments unless an exemption or exclusion fits. For ecommerce, that usually means EMV 3-D Secure: your side sends transaction and device data; the issuer decides whether to let the payment through quietly (frictionless) or challenge the customer (one-time code, banking app, biometrics).

Sometimes the issuer declines the authorisation and asks for SCA instead. That is a soft decline, not a final “no” — a classic 3D Secure decline path. Visa commonly signals this with response code 1A. Mastercard commonly uses 65. The right move is to authenticate the customer with EMV 3DS, then resubmit the authorisation with the authentication data. Do not keep retrying the same unauthenticated request and hope.

If your gateway does not handle that path cleanly, good customers drop out at the challenge, or never get challenged when they should have been, and you lose the sale either way.

3. At the issuer (including false declines)

The customer's bank can still say no after authentication: not enough funds or credit, velocity or fraud rules, travel or unusual spend patterns, or a card that is blocked for ecommerce. Some of those are soft. Some are hard. The response code and any merchant advice code tell you which.

Issuers also decline payments that look risky even when the cardholder is genuine. That is a false decline. More data in the 3DS request and a sensible risk set-up usually help more than shouting at the acquirer.

4. At the acquirer or scheme rules

Less common day to day, but real: MCC or sector restrictions, missing or wrong indicators (for example on recurring or merchant-initiated payments), or a set-up that does not match how you actually sell. If you sell subscriptions, cross-border, or in a specialist sector, this is worth a proper look with someone who sees how ecommerce payments are set up across acquirers.

What a useful decline report looks like

Ask for a decline report you can actually use. Not a single “declined” bucket. You want:

• Card approval rate, by channel (online, in-store, recurring)
• Top payment decline codes and reasons, soft vs hard
• SCA / 3DS challenge rate, success rate, and abandonment
• Retries: how often you retry, and whether soft declines are handled correctly
• Any scheme or acquirer warnings about excessive failed authorisations

Then pick the two or three reasons that cost you the most sales and work those first. Chasing twenty codes at once usually changes nothing.

How to improve your card approval rate without switching

Switching is not always the answer. Plenty of approval problems sit on the current stack:

• Make sure soft-decline codes (including SCA 1A / 65) trigger authentication, then a clean resubmit
• Send the data EMV 3DS expects so more payments stay frictionless
• Stop retrying hard declines; retry soft ones on sensible timings
• Fix checkout friction that looks like a decline (timeouts, broken 3DS redirects, wallet failures)
• Check recurring and credential-on-file flags are set correctly so renewals are not treated like brand-new risky payments
• Review gateway fraud rules that may be blocking good domestic customers

If you have been turned down for an account before, or you sit in a specialist sector, the placement and the rules matter as much as the rate. That is a different conversation: see higher-risk payments.

One-page checklist: cut lost sales from declined card payments

Take this into your next call with your acquirer or gateway.

• What is my card approval rate this quarter, by channel?
• Soft decline vs hard decline: can we split the top payment decline codes that way?
• Are Visa 1A and Mastercard 65 (SCA / 3D Secure soft declines) handled with EMV 3DS, then a resubmit?
• What is our 3DS challenge rate, success rate, and drop-off?
• Are we sending the authentication data fields the schemes expect?
• How many times do we retry a soft decline, and on what schedule?
• Do we stop after hard declines (lost, stolen, closed, do-not-retry)?
• Are recurring / merchant-initiated payments flagged correctly?
• Which gateway fraud or velocity rules have caused false declines on good UK cards?
• Who is the named person who owns approval rate with us?

Not sure what your reports are telling you? Send us a statement and a decline export if you have one. We will walk through it in plain English.

Frequently asked questions

Want a hand?

We have spent two decades in payments and work with 40+ acquirer partners. We see where good customers get lost, and which fixes are worth doing on your current set-up before anyone talks about moving.

Free rate review. No obligation. No hard sell. Or get in touch and tell us what you sell and where payments are failing.

Sources

Technical and regulatory claims in this piece were checked against:

• FCA: Strong Customer Authentication — UK SCA rules under the Payment Services Regulations 2017
• Visa: SCA for Remote Electronic Transactions Implementation Guide — Visa response code 1A and merchant retry via EMV 3DS
• Elavon UK: Card brand changes, March 2024 — SCA soft declines; authenticate with 3DS then resubmit; Mastercard merchant advice codes
• EMVCo: EMV 3-D Secure — how EMV 3DS frictionless and challenge flows work between merchant and issuer

Any example rates or “one in ten” style figures above are illustrations only, not benchmarks or promises.