Hard Decline

A hard decline is a card payment rejection in which the issuing bank signals that the transaction should not be retried with the same card — the underlying problem will not resolve on its own. It contrasts with a Soft Decline, which is a temporary refusal that may succeed on a subsequent attempt.

Definition and distinction from soft declines

A hard decline occurs when the issuer permanently blocks a transaction because the card itself is compromised, invalid, or the account is closed. The instruction conveyed to the merchant is: do not retry this card. (Stripe Resources, "Do not honor card refusals", updated 2026-07-17; Checkout.com Blog, "Card Issuer Rejection Explained", 2024-11-29)

A soft decline, by contrast, is a temporary issue — insufficient funds, a failed authentication step, or a momentary issuer unavailability — where a retry may succeed. (Stripe Resources, 2026-07-17; Slicker Blog, 2026-05-15)

Common causes of hard declines (Stripe Resources 2026-07-17; PaymentCloud Blog 2025-09-11; Chargebacks911 2026-08-04):

Card reported lost or stolen
Card account closed or permanently blocked
Card number does not exist or is invalid
Account flagged for confirmed fraud
Card restricted by issuer for specific transaction types
PIN attempts exceeded (chip-and-PIN scenarios)

The ambiguity of "Do Not Honour" (Code 05)

Code 05 is soft, not hard — despite appearances. Stripe, Adyen, Braintree, and Checkout.com all classify ISO decline code 05 ("Do Not Honour") as a soft decline (retryable). This contradicts the intuition that "do not honour" is a hard stop. Stripe explains (2026-07-17): issuers use Code 05 as a generic catch-all when their legacy infrastructure cannot communicate a specific reason — it may reflect insufficient funds, a temporary fraud hold, or a daily limit breach, all of which can resolve. Primer (Jeffrey Lin, Senior Solutions Engineer, retrieved 2026-08-10) adds that card scheme monitoring programmes (Mastercard's Data Integrity Monitoring Programme; a similar Visa programme) now cap issuer overuse of Code 05 for card-not-present declines, with the expectation that more specific codes gradually replace it.

The practical implication: a merchant seeing Code 05 alone cannot determine hard vs soft without checking the accompanying Merchant Advice Codes (MAC).

Merchant Advice Codes (MACs) — the modern arbiter

Visa and Mastercard overlay their decline codes with Merchant Advice Codes (MACs) that provide explicit retry guidance. The MAC — not the ISO decline code alone — is the authoritative signal for hard vs soft classification in modern payment stacks. (Slicker Blog, 2026-05-15)

MAC	Description	Merchant action
02	Cannot approve at this time, try later	Retry after wait — soft
03	Do not try again	Hard stop; cancel subscription or request new payment method
21	Payment cancellation	Stop all retries immediately
24	Retry after 1 hour	Queue retry
25–30	Retry after 24 hrs / 2–10 days	Time-boxed retry

The same ISO code 05 can arrive with MAC 02 (soft — retry eligible) or MAC 03 (hard — absolute stop). The code alone is ambiguous; the MAC resolves it. (Slicker Blog, 2026-05-15)

Slicker further notes: "Roughly 25% of MAC 03 cases still recover under specific conditions" — card type, issuer behaviour, payday timing — with machine-learning models identifying recovery windows. (Slicker Blog, 2026-05-15)

[!unverified] The 25% MAC 03 recovery claim originates from Slicker (a retry-optimisation vendor) and has not been independently verified. Treat as directional signal only.

Decline code taxonomies by PSP

No universal standard governs how PSPs surface hard vs soft declines — each PSP has its own abstraction layer on top of raw ISO/scheme codes.

Stripe

Stripe does not use "hard decline" / "soft decline" terminology in its API responses. It surfaces:

decline_code — a string identifier (e.g. lost_card, stolen_card)
outcome.advice_code — set to "do_not_try_again" for hard-stop scenarios

Stripe codes that map to a hard decline (do not retry): lost_card, stolen_card, pickup_card, restricted_card, fraudulent, expired_card, card_not_supported, pin_try_exceeded, invalid_account, merchant_blacklist. (Stripe Docs, retrieved 2026-08-10)

Stripe security note: Codes lost_card and stolen_card must not be surfaced to the cardholder; Stripe instructs merchants to display them as generic_decline to avoid exposing issuer fraud intelligence. (Stripe Docs, retrieved 2026-08-10)

Adyen

Adyen returns refusalReasonCode (numeric) and refusalReason (text). Adyen explicitly warns: "To prevent malicious use, do not expose the details of the refusal reason to shoppers." (Adyen Docs, © 2026)

Hard-decline refusal codes in Adyen:

Code	Refusal reason	Notes
5	Blocked Card	Consolidates ISO 41 (Lost) and 43 (Stolen)
6	Expired Card	Permanent — card expired
8	Invalid Card Number	Card number does not exist
14	Acquirer Fraud	Fraud flagged by acquirer
18	Pin tries exceeded	Permanent PIN block
20	FRAUD	Adyen fraud score ≥100; refused
22	FRAUD-CANCELLED	Combined pre+post fraud score ≥100
23	Transaction Not Permitted	ISO 57/58; not permitted to cardholder/terminal
24	CVC Declined	Invalid card security code
25	Restricted Card	ISO 62; card restricted
26	Revocation Of Auth	Shopper revoked recurring auth (R0, R1, R3)
31	Issuer Suspected Fraud	Issuer-flagged suspected fraud
46	Excessive retry block	Adyen blocking to prevent scheme penalty fees
50	Token Revoked	Shopper revoked recurring token

(Adyen Docs, retrieved 2026-08-10)

Notable: Adyen Code 27 ("Declined Non Generic") explicitly absorbs Mastercard response code 05 (Do Not Honor), separating it from more specific declines. Code 46 (Excessive Retry Prevention) is an Adyen-proprietary code — the PSP itself blocks retries to protect the merchant from accumulating scheme penalty fees. (Adyen Docs, retrieved 2026-08-10)

Braintree / PayPal

Braintree definition — Hard decline: "the decline is not temporary and subsequent attempts with the same payment method will likely not be successful." Soft decline: "result from a temporary issue and can be retried."

Key Braintree hard decline codes:

Code	Text	Network restriction
2004	Expired Card	Do not retry (ECI flag rule applies)
2005	Invalid Credit Card Number	Do not retry with same info
2007	No Account	Card not on file with issuer
2009	No Such Issuer	Mastercard prohibits retries
2012	Processor Declined – Possible Lost Card	Mastercard prohibits retries
2013	Processor Declined – Possible Stolen Card
2014	Processor Declined – Fraud Suspected
2019	Invalid Transaction	Mastercard prohibits retries
2022	Declined – Updated Cardholder Available	Mastercard prohibits retries; use account updater
2047	Call Issuer – Pick Up Card	Mastercard prohibits retries
2053	Card reported as lost or stolen	Mastercard prohibits retries
2108	Closed Card	"Do not reattempt with same PAN or token"

Checkout.com

Checkout.com uses a numeric range taxonomy (as-of 2026-07-29):

20xxx = Soft decline — "subsequent attempts may succeed"
30xxx = Hard decline — "Most hard declines require the issuer or cardholder to fix any outstanding issues before you can retry"

Key 30xxx hard decline codes:

Code	Text	Merchant action
30004	Pick up card (No fraud)	Try different card
30007	Pick up card – Special conditions	Try different card
30015	No such issuer	Card invalid/restricted
30033	Expired card – Pick up	Try different card
30034	Suspected fraud – Pick up	Do not reattempt; contact issuer
30041	Lost card – Pick up	Try different card
30043	Stolen card – Pick up	"Do not retry. If possible, do not provide goods or services to the person attempting."
30044	Transaction rejected – AMLD5	Anonymous prepaid card >€50; unfulfillable
30046	Closed account	Contact bank

Important nuance: Checkout.com classifies 20005 (Do Not Honour / ISO 05) as a soft decline (20xxx range), consistent with all other PSPs, despite the apparent finality of the phrase. (Checkout.com API Docs, updated 2026-07-29)

Cross-PSP alignment on key ISO codes

ISO code	Meaning	Stripe	Adyen	Braintree	Checkout.com
05	Do Not Honor	Soft (`do_not_honor`)	Code 27 — Soft	2000 — Soft	20005 — Soft (20xxx)
41	Lost Card	Hard (`lost_card`)	Code 5 — Hard	2012 — Hard	30041 — Hard
43	Stolen Card	Hard (`stolen_card`)	Code 5 — Hard	2013/2053 — Hard	30043 — Hard; explicit "do not retry"
04	Pick Up Card	Hard (`pickup_card`)	N/A explicit	2041/2047 — Hard	30004/30007 — Hard

ISO 62 (Restricted Card) — Hard or Soft? Braintree labels code 2057 ("Issuer or Cardholder has put a restriction on the card") as Soft. Adyen's Code 25 ("Restricted Card") and Checkout.com's 30036 ("Restricted card – Pick up") classify similar signals as Hard (30xxx). The discrepancy likely reflects sub-code differences in the underlying issuer response. Primary Visa/Mastercard operating rules (paywalled) are the authoritative reference; neither was directly retrievable for this entry.

ISO 14 (Invalid Card Number) — Hard or Soft? Adyen (Code 8) treats it as hard; Checkout.com (20014) treats it as soft (retryable if customer corrects the number); Stripe frames it as an opportunity to ask the customer to recheck their card number. The divergence likely reflects the use case: a typo at checkout (soft — customer can correct it) vs. a card number that simply does not exist in any issuer database (hard). No authoritative resolution available without primary scheme documents.

Scheme penalties for retrying hard declines

Retrying a hard decline — particularly one with a MAC 03 or Category 1 signal — exposes merchants to escalating scheme penalties.

Visa (as-of 2026; Slicker Blog 2026-06-16):

Maximum 15 retry attempts per card per 30-day rolling window (across all decline types)
Hard declines (Category 1): 1 attempt only — no retries permitted
Per-excess-retry fee: $0.10 domestic / $0.15 international
Visa Merchant Monitoring Program flags merchants with >15% decline rate or >1,000 monthly decline transactions; fines: $5,000–$75,000/month

Mastercard (as-of 2025–2026; multiple sources):

MAC 03 / MAC 21 = absolute stop; retrying triggers Excessive Authorisation Programme fees
Mastercard Excessive Authorisation Programme fee: $0.50/transaction for non-compliant retries (as-of 2025-01; Slicker 2026-06-16; multiple)
From January 2026: fee expanding to all declined card-not-present transactions bearing MAC 03 or 21 — not just explicit retries (Merchant Risk Council, 2026-08-04; Slicker 2026-06-16)

Mastercard retry penalty fee figure (two conflicting Slicker articles): Slicker (2026-05-15) states Mastercard fees are $0.03–$0.50 per excess retry. Slicker (2026-06-16) states $1.00 per excess retry escalating to $2.00. These may refer to different tiers: the May article may reference per-transaction network-level fees; the June article may reference the Excessive Attempts programme monthly fine schedule. Neither article cites primary Mastercard documentation. Mastercard's operating rules are paywalled; the contradiction cannot be resolved from publicly available sources.

Benchmarks

All decline rate benchmarks below are volatile and methodology-dependent. Sources use different bases (all card transactions vs CNP only vs recurring only). Treat as directional, not precise.

Hard declines = 10–20% of all failed transactions; soft declines = 80–90% (as-of 2024–2026; Chargebacks911, retrieved 2026-08-04)
Overall ecommerce payment decline rate: 7.9–17%, varying by segment (as-of 2024–2025; Alexander Jarvis estimate; Chargebacks911; Wallid.co)
Recurring / subscription decline rate: ~15% average; some sectors >30% (as-of undated; Wallid.co, no methodology disclosed)
Account updater services: 3.8x higher approval rate for recurring payments (as-of 2025; Mastercard Automatic Billing Updater documentation, cited in PaymentCloud Blog 2025-09-11)
False declines: $231B projected global merchant losses in 2026, rising to $265B in 2027 (as-of 2026; Signifyd / Beastinsights; volatile projection)
False decline losses vs fraud losses: ~$443B vs ~$48B globally — false declines cost ~13x more than the fraud they prevent (as-of cited 2024; Javelin research, widely cited)
56% of US consumers experienced a false payment decline in the previous three months (as-of 2024; PYMNTS research)
32% of falsely declined customers say they would not return to that merchant (as-of 2024; PYMNTS research)

UX handling

Card scheme rules and PCI DSS guidance prohibit merchants from displaying raw decline codes or the specific decline reason to cardholders. Displaying "Code 43: Card Stolen" would expose issuer fraud intelligence and violate network rules. (Adyen Docs © 2026; Stripe Docs retrieved 2026-08-10; Chargebacks911 2026-08-04)

Recommended hard decline UX (Checkout.com Blog 2024-11-29; Chargebacks911 2026-08-04):

Show a generic but clear message: "Your card was declined — please contact your bank or try a different card."
Immediately surface alternative payment methods at the decline screen: Apple Pay, Google Pay, PayPal, BNPL
Do not offer a "try again" button for hard declines (appropriate only for soft declines)
For subscriptions: send a dunning email routing the customer to a payment method update page; do not queue an automated retry

Soft vs hard UX distinction (Slicker Blog 2026-05-15):

Soft decline: scheduled automated retry + friendly email ("We'll try again in a few days")
Hard decline: immediate payment method update request only; same friendly tone repeated for 5+ emails reads as not paying attention

Input validation to prevent avoidable declines (Checkout.com Blog 2024-11-29):

Luhn algorithm check on card number entry (catches typos before authorization)
Real-time CVV format validation
Address autocomplete to reduce AVS mismatch soft declines

Connection to fraud and false declines

Hard declines on stolen/lost cards are an issuer-side fraud signal. Repeatedly attempting authorization on a flagged card can trigger issuer pattern recognition that increases future decline rates for that merchant with that issuer. (Checkout.com Blog 2024-11-29)

False Decline — legitimate transactions wrongly rejected — represents a distinct but connected problem. Per Checkout.com proprietary research (undated): 42% of consumers surveyed report being deterred from returning to a site after one falsely declined payment; 45% refused to continue with a purchase.

[!unverified] The 42% and 45% consumer deterrence figures are from Checkout.com's own unpublished "Hidden Billion Dollar Opportunity" guide, no external peer review cited.

For fashion ecommerce and luxury goods, false declines from high-ticket legitimate purchases are a known problem: issuers flag large transactions as anomalous, creating False Decline losses that can exceed fraud losses by a significant margin. (Javelin research, cited in PaymentCloud Blog 2025-09-11)

Key terms

Term	Meaning
Hard decline	Permanent issuer rejection; do not retry with that card
Soft decline	Temporary issuer rejection; retry may succeed
ISO decline code	Numeric code (e.g. 05, 41, 43) from the card scheme communication standard
Merchant Advice Code (MAC)	Visa/Mastercard overlay code prescribing retry eligibility, more specific than ISO code alone
Do Not Honour (Code 05)	Generic issuer decline; classified as soft by all major PSPs despite its apparent finality
Refusal reason	PSP's own label (e.g. Adyen "Blocked Card", Stripe "stolen_card") abstracting the raw ISO code
Pick Up Card (Code 04/07)	Issuer requests physical card be confiscated; implies lost/stolen — hard decline
Excessive Authorisation fee	Scheme penalty charged when a merchant retries a declined transaction beyond permitted limits
Account updater	Service that automatically updates stored card credentials when a card is replaced, reducing hard declines from expired/reissued cards
False decline	Legitimate transaction rejected by issuer or merchant fraud system — distinct from hard decline