Card decline codes: soft and hard declines, and what Visa lets a merchant retry

What a decline code is

When a card payment is authorized, the merchant’s acquirer sends the request through the card network to the bank that issued the card. If the issuer refuses, the answer carries a two-character response code. Merchants and their providers call it the decline code; it is what a payment page, terminal or billing system shows as the reason.

The code is the issuer’s choice, made within the network’s rules. Visa’s section 7.3.6.3 requires an issuer that declines an authorization request or an account verification to send the code that most accurately reflects the reason for the decline. The same section then sets what the merchant may do next, code by code, in table 7-2.

Everything quoted here comes from Visa’s published rules, edition of 24 October 2026, opened on 15 November 2026. Other card networks set their own rules for declines and retries; see the last section.

Soft and hard declines: the shorthand and Visa’s own terms

“Hard decline” usually means a refusal that will not change if the payment is tried again, and “soft decline” one that might, such as a temporary lack of funds. Neither phrase appears in Visa’s table. Visa uses four categories instead, and the category, not the shorthand, decides whether a retry is allowed.

The difference matters because the shorthand and the table do not always agree. Code 59 (suspected fraud) sounds final, yet Visa places it in category 2, where a reattempt is permitted within the limit. Code 05 (do not honor) does not appear by name in the table at all, so it falls under category 4, which covers all other decline codes. Code 57 (transaction not permitted to cardholder) sounds temporary but sits in category 1, where a merchant must never resubmit.

Visa’s four decline categories and the merchant reattempt limits

Table 7-2 sets an issuer requirement and a merchant reattempt limit for each category. The table below gives the codes Visa lists, in Visa’s words, and the limit that applies.

Scroll the table to see all columns.

Two issuer rules sit in the table’s notes. After sending a category 1 code, an issuer must consistently send the same code, so a retry on a closed or stolen card returns the same answer. And from 24 October 2026 an issuer must not use code 51 (not sufficient funds) in response to an account verification; in Chile the change takes effect on 2 November 2026. Code 83 carries an effective date of 25 July 2026 in the table.

The table’s limits are written for the same payment credential. Separate rules apply to mobility and transport merchants (section 7.3.6.2), which this guide does not cover.

What a retry may not change

A permitted reattempt is the same payment tried again, not a different payment dressed to get past the decline. Visa’s section 1.7.2.1 says an acquirer, merchant, payment facilitator or processor that reattempts an authorization after a decline must not intentionally manipulate any data elements from the original request. Visa names, among others, the acquiring identifier, the acquirer and merchant country, the merchant category code, the POS condition code, the POS environment field, the POS entry mode and the electronic commerce indicator, and says the merchant outlet country must stay the same throughout the transaction’s life cycle.

For a business in a high-risk category this is the rule that matters most. Retrying through another merchant account, under another category code or with a changed country or environment indicator is what the section forbids. What a merchant can do is keep within the reattempt limits, ask the customer to re-check the card details where the code points to a data problem (Visa titles category 3 “revalidate payment information”), and offer another way to pay.

Declines on stored cards and subscriptions

Visa’s table 5-21 adds rules for cards kept on file. Before storing a card, the merchant must either authorize the transaction amount or, if no payment is due, submit an account verification; if that first request is not approved, the merchant must not store the card. If an authorization for a merchant-initiated payment on a stored card is later declined, the merchant must notify the cardholder in writing and allow at least 7 calendar days to pay by other means.

Three category 1 codes speak directly to recurring billing: R0 (stop this payment), R1 (stop all future payments) and R3 (stop all merchants). After any of them, table 7-2 says a merchant must never resubmit for the same payment credential.

Out-of-date card details are a separate cause with a separate fix. A replaced, closed or expired card can produce codes such as 14 (invalid account number), 46 (closed account) or 54 (expired card); our guide on card account updaters covers how stored card details are kept current.

US federal law sets its own conditions for online subscriptions. Under 15 U.S.C. 8403 it is unlawful to charge or attempt to charge a consumer through a negative option feature in an internet transaction unless the seller clearly and conspicuously discloses all material terms before obtaining billing information, obtains the consumer’s express informed consent before charging, and provides simple mechanisms to stop recurring charges. This guide states what that section says; it does not say how it applies to any business.

Other card networks

This guide covers Visa’s rules only. Other card networks set their own rules for declines and retries, and Visa’s categories and limits should not be assumed to apply to them. Mastercard’s transaction processing rules refused unattended reading when this guide was written on 15 November 2026 and were not read, so this guide states nothing about them. A merchant that accepts several networks should ask its acquirer for each network’s current retry rules in writing.

What to ask a provider about declines and retries

• Does your gateway or billing system return the issuer’s raw decline code, or only its own message? Can I see the code for every declined payment?
• Does your retry logic stop after category 1 codes and count attempts against Visa’s 20-in-30-days limit for the same card?
• Do retries go out with the same merchant account, category code, country and environment data as the first attempt?
• Do you charge per authorization attempt, including declined attempts and retries, and how much? What a provider charges a merchant is set by the provider.
• Which other card networks do you process, and where are their retry rules written?

Questions, answered