Recovering Failed Payments: A Practical System

Read the decline before you do anything

Visa's rules require issuers to send the decline response code that most accurately reflects the reason. The rules group codes as follows. Category 1, issuer will never approve, includes 04 pick up card, 14 invalid account number, 41 lost card, 43 stolen card, 46 closed account, R0 stop payment order, and R1 and R3 revocation of authorization orders. Category 2, issuer cannot approve at this time, includes 51 not sufficient funds, 59 suspected fraud, 61 exceeds approval amount limit, 91 issuer or switch inoperative and 96 system malfunction. Category 3, data quality, includes 54 expired card or expiration date missing and N7 decline for CVV2 failure. Category 4 is every other code. Your gateway or processor may show its own labels, so ask it to pass through the underlying network code.

Retry limits are a ceiling, not a schedule

For Category 1, Visa says a merchant must never resubmit an authorization request or account verification for the same payment credential. For Categories 2, 3 and 4, reattempts are permitted up to 20 attempts in 30 days. That is the maximum the rules allow, not a recommended plan. A sensible process matches the retry to the reason. An insufficient-funds decline may succeed later. An expired card needs new details, not the same data sent again. A system malfunction may clear quickly. Illustrative example only, not a Visa recommendation: a subscription business might retry insufficient-funds declines two or three times over a couple of weeks, ask customers with expired cards to update their details straight away, and stop at once on any Category 1 code.

Do not change the data to force approval

Visa's rules say a merchant, acquirer, payment facilitator or processor that reattempts after a decline must not intentionally manipulate data elements from the original authorization request. The list includes the acquiring identifier, acquirer and merchant country, merchant category code, POS condition code, POS environment field, POS entry mode and electronic commerce indicator. Retrying the same charge as a different type of transaction, or through a different merchant setup, is exactly what this rule targets.

Tell the customer and give them time

Visa's stored-credential rules say that if an authorization for a merchant-initiated transaction with a stored credential is declined, the merchant must notify the cardholder in writing and allow at least 7 calendar days to pay by other means. Treat that as a floor rather than a target: the sooner the customer hears, the more of the 7 days they can actually use. A clear message names the charge, the amount, the reason in plain words where you can, and a secure link to update the card or pay another way. Our card-on-file guide covers the consent and disclosure rules that apply before you store a card.

Let an account updater handle reissued cards

Visa describes Visa Account Updater as a secure exchange of account updates between participating issuers and acquirers for credential-on-file merchants. Merchants, through their acquirers, send inquiries and receive updated information if available: new account numbers or expiry dates, closed account advices and contact cardholder advices. Visa's rules require US issuers to enroll their BINs, except commercial and prepaid card BINs. The consent side is covered by Visa's stored-credential rules, which require the cardholder agreement to state the account number that will be used to make payment, last four digits only, as it may be updated from time to time, and to say how the cardholder will be notified of any change to the agreement. Visa also requires the merchant to retain that information for the duration of the agreement and provide it to the cardholder or issuer on written request. Other card networks run their own updater services under their own rules, so ask your processor which networks are actually covered, whether updater services are on, and how often stored cards are checked.

Keep a simple recovery log

Track every failed charge with the date, amount, decline code, category, each retry and the outcome. Illustrative example only, with made-up round numbers: of 100 failed charges in a month, a business might see 40 insufficient funds, 30 expired cards, 20 Category 1 codes and 10 other declines. Each group needs a different response: timed retries, a card update request, no retry at all, and a check with the processor. Review the log monthly so the process follows your own results.