Payment authorization rate: how to measure it, read declines and follow the card networks’ retry rules

Your payment authorization rate is the share of card authorization requests the issuing banks approve: approvals ÷ attempts. Track it per order too, since retries inflate attempts. Hard declines (a closed account, a stolen card) will never be approved and must not be retried. Soft declines may pass later, within limits: since May 19, 2025, Visa has allowed up to 20 reattempts of a payment in 30 days.

Here's an illustrative week at a store where 1,000 orders reached the pay button. Second tries turned them into 1,150 authorization attempts, so the same 905 approvals give two different rates:

One week of card payments

Illustrative store: 1,000 orders reached the pay button

1. Authorization attempts1,000 orders plus 150 second tries1,150
2. Approved by the issuer78.7% of the step before905
3. Captured99.1% of the step before8 approved orders voided as suspected fraud before shipping897

How to calculate your payment authorization rate

Every card payment starts with an authorization. Your processor asks the bank that issued the card to approve the amount, and the bank answers with a response code. An approval holds the amount on the card. A decline means there's no sale. The rest of the trip, from capture to payout, is in how payment processing works.

The basic formula is approved authorizations ÷ authorization attempts: 905 ÷ 1,150 = 78.7% in the week above. Count it a second way as well, approved orders ÷ orders that reached the pay button: 905 ÷ 1,000 = 90.5%.

The two differ because of second tries. A buyer who mistypes the card number and then gets it right is one order and two attempts; so is a buyer who switches cards, or a payment your processor retries. The per-attempt rate shows how the banks treat your requests; the per-order rate shows how many buyers you actually lost. When someone quotes an authorization rate, ask which one they mean.

Then put a price on the gap. Say ads cost this store $42 for every order that reaches the pay button, and the average order is $85. The 95 orders that never got through cost $3,990 to bring in and would have brought $8,075. Each point of per-order approval rate is 10 orders a week here, $850 of sales the funnel had already won. A buyer lost at the pay button has already used up the whole funnel's cost, which makes a decline the most expensive place to lose one.

Two counting rules keep the number honest. Keep payments your processor's own fraud filter blocked on a separate line: Stripe's Radar, for example, can block payments by rule (Stripe), and that's the processor's decision, not the bank's. And watch the last step too. Only captured payments collect money, and only captured payments can turn into the disputes your chargeback ratio counts.

Soft decline vs hard decline: what the codes tell you

The response code is the issuer's answer, and the card networks group those answers by what they let you do next.

Visa sorts decline codes into four categories (Visa's rules bulletin). Category 1 means the issuer will never approve, as with a lost or stolen card or a closed account. Category 2 means it can't approve at this time. Category 3 covers data quality: the card details were wrong. Category 4 holds generic codes, such as 05, "Do not honor", which give no reason.

Mastercard adds a merchant advice code to some declines (Mastercard). The ones that matter most: 01, new account information available; 02, cannot approve at this time, try again later; 03, do not try again; 21, payment cancellation; and 24 to 30, try again after 1 hour, 24 hours, or 2, 4, 6, 8 or 10 days.

"Hard" and "soft" are the industry's shorthand for this split, and in practice the codes fall into three groups:

Hard declines, bad data and soft declines

Visa decline categories and Mastercard merchant advice codes

Don’t retryHard decline

• Visa Category 1: the issuer will never approve (a lost or stolen card, a closed account)
• Mastercard 03: do not try again
• Mastercard 21: payment cancellation, such as a stopped recurring payment

Ask the customer for another way to pay.

Fix it, then retryBad or old data

• Visa Category 3: data quality, the card details were wrong
• Mastercard 01: new account information available
• Mastercard 04: token requirements not fulfilled for this token type

The same details will fail the same way.

Retry later, within limitsSoft decline

• Visa Category 2: the issuer cannot approve at this time
• Visa Category 4: generic codes such as 05, "Do not honor"
• Mastercard 02: try again later
• Mastercard 24 to 30: retry after 1 hour, 24 hours, or 2, 4, 6, 8 or 10 days

Since May 19, 2025, Visa allows up to 20 reattempts in 30 days for Categories 2, 3 and 4, per processor documentation.

How many times can you retry a declined card?

Visa's rule is the clearest. A Category 1 decline may never be reattempted. Visa's bulletin, effective April 17, 2021, let a Category 2 decline be reattempted up to 15 times in 30 days, and since May 19, 2025, the limit has been 20 reattempts in a rolling 30 days for the same card, amount and currency, with customer-initiated and merchant-initiated retries counted separately (Checkout.com). The limit covers Category 2, 3 and 4 declines (PayPal).

Some processor pages still print the old number. Adyen's fee mapping gives 15 in 30 days for Categories 2, 3 and 4 (Adyen), and Stripe's support note sums up Visa's rules as broadly prohibiting more than 15 retries of a single payment over 30 calendar days, adding that Stripe may block retries after the 15th when it judges the chance of success to be low (Stripe). Ask your processor which limit its automatic retries follow.

Breaking the rule costs money. Processor documentation from PayPal says Visa charges a fee for any retry of a Category 1 decline and for every reattempt past 20 in 30 days, which processors pass on. Checkout.com's fee list puts it at about $0.10 per domestic retry (Checkout.com). That's small per payment, but it adds up on a subscription base that rebills thousands of cards.

For Mastercard, the fee details also come from a processor. According to Checkout.com's fee documentation, Mastercard charges a fee for a retry within 30 days after advice code 03 or 21, and an excessive-authorization fee for a retry after more than 10 declined attempts within 24 hours, or more than 35 within a rolling 30 days.

Put together, every decline should go through the same five steps:

Handling a decline, step by step

1. 1Read
2. 2Stop
3. 3Fix
4. 4Wait
5. 5Record

1Read the response

What happens: Log the decline code and, on Mastercard, the merchant advice code that came with it.

Why it matters: The code decides whether a retry is allowed at all, and when.

What goes wrong:

• A dashboard that only says "card declined": ask your processor for the raw codes
• Treating every decline the same way

2Hard decline: stop

What happens: Visa Category 1, or Mastercard 03 or 21: no retry. Ask the customer for another way to pay; on a subscription, a 21 means stop billing.

Why it matters: Visa doesn’t permit reattempts of Category 1 declines, and processors pass on the network fees for retries like these.

What goes wrong:

• A rebill schedule that keeps retrying a canceled payment
• Resubmitting the same card as a new payment

Read more: Supplement Subscription: Economics, Offer and Rules

3Wrong or old data: fix it first

What happens: Visa Category 3 (the card details were wrong) or Mastercard 01 (new account information available): get the corrected or updated card before you try again.

Why it matters: The same data will fail the same way; a corrected card has a real chance.

What goes wrong:

• Retrying with the old expiry date
• No card updater on stored cards

4Soft decline: wait, then retry

What happens: Visa Category 2, Mastercard 02, or Mastercard 24 to 30 with a stated wait: retry on a schedule, never seconds later.

Why it matters: The issuer said not now, not never. Since May 19, 2025, Visa allows up to 20 reattempts in 30 days, counting customer-initiated and merchant-initiated retries separately.

What goes wrong:

• Automatic retries every few minutes
• Counting retries per order instead of per card payment

5Record the outcome

What happens: Note whether the retry was approved, after how long, and for which BIN.

Why it matters: Your own recovery rate by code tells you which retries are worth making.

What goes wrong:

• No record of retries, so the next schedule is a guess

Rebills and subscriptions: where stored cards fail

A rebill, a charge you start on a stored card without the customer at the checkout, fails for reasons a first order doesn't face: the card on file expired, the bank replaced it after a loss, or the account closed. The supplement subscription post covers the dunning emails that ask the customer for a new card. Two network services reduce how often you need them.

Card updaters. The Visa Account Updater sends participating merchants updated details for cards on file. Visa says it "supports only account number and expiration date changes", plus closed-account and contact-cardholder recommendations, so a new name or address won't come through (Visa). Mastercard's Automatic Billing Updater passes changed account numbers and expiration dates from issuers to registered merchants (Mastercard). Both reach you through your acquirer, so in practice they're often a setting your processor switches on.

Network tokens. A network token stands in for the card number. Visa describes its tokens as replacing the 16-digit account number with a digital token that only Visa can link back to it. Visa also says tokens let issuers update expired or compromised credentials without the customer doing anything (Visa's 2022 fact sheet). Both networks have published approval figures:

What the networks say tokens do for approvals

Network-wide claims, in each network’s own words

3%Visa, August 2022: higher approval rates with tokens, in its analysis of more than 8,600 issuers and 800,000 merchantsVisa, 24 Aug 2022

6 bpsVisa, June 2024: "a six-basis point increase in payment approval rates globally"Visa, 4 Jun 2024

3–6 ptsMastercard, November 2024: tokenization "growing transaction approvals by 3-6 percentage points across regions"Mastercard, 13 Nov 2024

Read them with care. They come from different analyses, scopes and years, and six basis points is 0.06 of a percentage point, far smaller than Visa's 2022 figure. None of them predicts what your store will see. Ask your processor whether it uses network tokens for stored cards, then compare your rebill approvals before and after.

Two advice codes need a rule of their own on rebills. Code 21, payment cancellation, is what you get when, for example, a cardholder has stopped a recurring payment through their bank: stop billing that customer and don't retry. Code 01 means new account information is available: get the updated card through the updater or from the customer, then charge again.

What raises approvals without hiding anything from the bank

Most of what lifts an authorization rate comes down to giving the issuer accurate information and asking at the right time:

1. Send complete card data. Ask for the CVC and the billing postal code. Stripe notes that a postal code isn't always required to process a card payment, but including it lets the issuer verify the payment, and that a failed check is a reason to consider rejecting the payment as possible fraud (Stripe). Validate the form before it submits, so a mistyped number or a past expiry date doesn't become a Category 3 decline.
2. Keep stored cards current with the updater and network tokens.
3. Retry on the code's schedule, not on a timer: never after Category 1, 03 or 21; after the stated wait for codes 24 to 30; within 20 reattempts in 30 days on Visa.
4. Authenticate where the issuer expects it. In the EEA and the UK, most customer-initiated online card payments need strong customer authentication under PSD2 and UK rules, with exemptions the bank decides (Stripe). If you sell to cardholders whose bank is in Europe, those issuers may decline payments that weren't authenticated, so offer 3D Secure for their cards. The US has no equivalent mandate; there, 3D Secure is optional and mainly used to shift fraud-chargeback liability to the issuer.
5. Capture what you authorize, in time. An authorization only holds the amount; capture collects it. Stripe lists 7 days for most networks' online payments the customer starts, and if you don't capture in time, the hold is released (Stripe). Pre-orders and backorders can outlive the hold.
6. Work with a processor that shows its work. Ask for raw decline codes rather than "card declined", approval rates by BIN and issuer country, whether the updater and tokens are on, and how its automatic retries count toward Visa's limit. For a supplement brand, underwriting settles a lot before the first card is run; the high-risk merchant account guide covers it.

How to measure your authorization rate by card brand, issuer country and BIN

A store-wide rate hides where the problem sits. Split it three ways each week: by card brand, by the country of the issuing bank, and by BIN, the first digits of the card number, which identify the bank that issued it. Add funding type (credit, debit, prepaid) if your processor reports it.

In this illustrative month, the US-issued cards look healthy and two segments carry the losses:

Approval rate by segment, one month

Illustrative store, per attempt

Visa, US-issued91.2%

Mastercard, US-issued89.8%

Cards issued outside the USlook at authentication and cross-border payments71.5%

One bank’s BIN rangesend the issuer’s BIN, dates and codes to your processor58.3%

Each pattern points somewhere different. A drop at one BIN range points to that bank: send your processor the BIN, the dates and the codes, because only the issuer knows why it declined. A drop for cards issued abroad points to authentication and cross-border payments. A drop across every brand and bank at once has one thing in common: you. Check your checkout, your processor settings and anything you changed recently before anything else.

Your VSL analytics can raise the alarm before a processor report does. In RevvyScales, each VSL shows CTA clicks next to the orders your checkout reports back, so if clicks hold steady while orders fall, look at payments before you rewrite the video (reading your analytics).

Tactics that hide information from issuers, and why they backfire

Some decline fixes work by keeping the issuer from seeing what's really happening. They trade a few approvals now for fees, a strained relationship with your acquirer and numbers you can no longer read:

• Resubmitting a hard decline as a new payment to reset the counter. Visa doesn't permit any reattempt of a Category 1 decline, however it's dressed up.
• Retrying on a loop whatever the code says. Past 20 reattempts in 30 days, Visa's fees apply, and the Mastercard fee in Checkout.com's summary starts after more than 10 declined attempts in 24 hours.
• Small authorizations you never intend to capture, used to "check" a card. Stripe warns that networks may restrict $1 authorizations you don't intend to capture.
• Describing the business as something else, or spreading sales across accounts and descriptors to look smaller. It hides the real picture from the bank and from you; the billing descriptor guide shows how Visa ties its monitoring to your descriptor.

The honest version is slower and keeps working: accurate data, the codes respected, and a processor that knows exactly what you sell.

A weekly authorization-rate check

Fifteen minutes with your processor's report, every Monday:

Weekly authorization-rate check

• Work out last week’s rate per attempt and per order
• Split it by card brand, issuer country, BIN and funding type
• List the five most common decline codes and Mastercard advice codes
• Confirm no Category 1, 03 or 21 decline was retried
• Confirm no payment went past Visa’s 20 reattempts in 30 days
• Check that the card updater and network tokens are on for stored cards
• Check that pre-orders and backorders were captured before their holds expired
• Compare checkout clicks with completed orders for each VSL
• Write down any change to the checkout, processor or retry settings, with its date

0 of 9 done

Once the weekly numbers are steady, change one thing at a time, such as switching on network tokens or a new retry schedule, and compare the next four weeks with the four before.