Visa now lets a merchant retry a soft-declined card up to 20 times in 30 days, not 15. The figure sits in Table 7-2 of the Visa Core Rules dated 18 April 2026, and Adyen's own retry documentation still says 15. If the incumbent guides and one of the biggest acquirers disagree on the headline number, your retry logic is probably keyed on something older still.
Most of the pages that rank for "card decline codes" are glossaries: a list of two-digit codes with a sentence each. That is the least useful way to think about them. A decline is three separate signals (the ISO 8583 response code, a scheme-level retry category or advice code, and whatever your PSP normalises them into) and the retry rules attach to the first two, not the third. This guide works from the scheme rules and the four PSP APIs as they stand in September 2026.
What Do Card Decline Codes Actually Mean?
The issuer's answer travels back in ISO 8583 Data Element 39, the response code. 00 is approved. Everything else is a reason for not approving, and the two-character value space is shared across schemes without being fully standardised by them. Visa publishes its meanings in the Core Rules. Mastercard publishes its own, plus a second signal: the Merchant Advice Code, which tells you what to do next rather than why it failed. Secondary sources consistently place the MAC in DE 48 subelement 84; Mastercard's interface specification that would confirm it sits behind a login.
The trap is that the same code can mean different things on different networks. Code 65 is the clearest example. On Visa it is "Exceeds withdrawal frequency limit", a Category 2 soft decline. On Mastercard in the UK and EEA, issuers use 65 to demand strong customer authentication, and Stripe's docs note that its authentication_required decline on Mastercard used to surface as withdrawal_count_limit_exceeded because some issuers had not updated their systems. If you map raw codes without the scheme alongside them, you will misroute a slice of your SCA traffic.
Visa Decline Categories in 2026: 20 Retries, Not 15
Visa sorts every decline response into four categories. Issuers must "send to VisaNet the Decline Response code that most accurately reflects the reason for the decline", and merchants are bound by the category's reattempt limit.
| Category | Meaning | Codes (Visa Core Rules, Apr 2026) | Merchant limit |
|---|---|---|---|
| 1 | Issuer will never approve | 04, 07, 12, 14, 15, 41, 43, 46, 57, R0, R1, R3 | Never retry |
| 2 | Issuer cannot approve at this time | 03, 19, 39, 51, 52, 53, 59, 61, 62, 65, 75, 78, 83, 86, 91, 93, 96, 5C, 9G, N3, N4, Z5 | 20 attempts in 30 days |
| 3 | Data quality, revalidate | 54, 55, 82, 6P, N7; in Europe and CEMEA also 70 and 1A | 20 attempts in 30 days |
| 4 | Generic | All other decline codes, including 05 | 20 attempts in 30 days |
Read the full article on tomcn.uk →
About the Author
I'm Tom Wang, an AI Developer & Fintech Developer — building AI agents, crypto payment infrastructure, and cross-border payout systems with Rust, Go, and TypeScript. Based in London, UK.
Currently open to new opportunities in fintech, crypto payments, and AI agent engineering.
