Gateway vs Issuer Decline Codes: Who Said No, and What Retries

A decline has three possible authors: your gateway, the processor host, and the bank. The code format tells you which one, and each layer has its own retry rule.

Most decline-code guides are dictionaries of the same ten numbers from ISO, the international standard that assigns card response-code numbers. The string in your gateway log is usually not one of them. It reads "declined by score 1", "gateway rejected", or "host code 51". It can also be a 500-series error or a five-digit code your processor invented. Those strings have three possible authors. Each author carries a different retry rule. This page shows you how to tell the authors apart from the log line, and what each answer is worth.

Who actually declined the payment: your gateway, the processor, or the issuer?

Three parties can refuse a payment. Only one of them is a bank. Your own gateway or fraud layer can stop the request before it leaves. The processor host can fail it on format or connectivity. The card issuer can decline it. Stripe and Braintree split payment failure the same three ways in their own docs.

• Your gateway or fraud layer. Braintree calls this a gateway rejection and says your own settings blocked it, not the customer's bank. The fix is a configuration change.
• The processor or the host. These are format, setup and connectivity faults. Braintree bands them as 3000-class, NMI numbers them 400-series, and Payabli documents its whole 500 band as transport failure with "retry the transaction" as the instruction.
• The card issuer. Only this layer obeys the rules in our soft decline versus hard decline guide, because only here did a bank make a decision about the card.

How do you read a decline response and find the issuer's real answer?

Read the source field before you read the code. Stripe exposes outcome.type and outcome.network_status. A blocked payment returns not_sent_to_network with both network codes null. A bank decline returns declined_by_network with a populated network_decline_code. Those fields settle the gateway decline vs issuer decline question, so you never guess. Braintree answers the same question with a status: Gateway Rejected, Processor Declined, or Failed.

• Stripe's outcome.type names the author, and only issuer_declined means a bank said no. The other values are blocked, invalid, manual_review and authorized.
• Stripe's outcome.reason is the wrapper and network_decline_code is the bank's raw code. Its generic_decline string covers both an unexplained bank decline and a Radar block, so the string alone will misattribute.
• Adyen returns refusalReason as its own normalized value and refusalReasonRaw as the untouched acquirer string, such as "51 : Insufficient funds/over credit limit". Both are off until you switch raw acquirer results on.
• Braintree ships the raw processor response off by default, which is one reason operators read a gateway dialect instead of the network code.
• NMI bands the answer by leading digit: 100 approved, 200 declined by the processor, 300 rejected by the gateway itself, 400 an error returned by the processor.
• Adyen returns HTTP 200 even for a refused payment, so the transport status tells you nothing about who refused it.

What does "declined by score 1" mean, and why did no bank see it?

It means your own fraud rules scored the order and stopped it. Cybersource reason code 481 means Decision Manager, the merchant's own rules engine, rejected the order. Adyen refuses under reason 20 when its pre-authorization risk score reaches 100. Authorize.net returns 251 when one of your filters triggers. You never asked a bank.

• Velocity filters are counters you set, not risk judgments. Authorize.net's hourly, daily and transaction IP velocity filters action everything over your own threshold.
• When several filters trip with different actions, the most severe action wins, so an unrelated filter can turn a "report" into a decline.
• Address verification (AVS) and card-code rejections are often post-authorization. Cybersource reason code 200 means the bank approved the authorization and your AVS setting then declined it, and 230 is the same construction for the card security code.
• Braintree's nine rejection reasons are all settings: 3D Secure, Application Incomplete, AVS, CVV, Duplicate, Fraud, Risk Thresholds, Token Issuance and Payment Method Blocked.
• PayPal Payflow RESULT 125 is a filter rejection, and switching that filter from Reject to Review turns the same order into RESULT 126 instead.
• Stripe blocks some payments on economics alone under Adaptive Acceptance, returning low_probability_of_authorization with advice do_not_try_again.

What is a host code, and what is "51 transaction not approved 481"?

A host code is the raw string from the system that answered. Processor decline codes sit on top of the network's answer. J.P. Morgan defines the host as the system it received a response from, and passes the unaltered host message through. Moneris uses a three-character host code in the Base24 format. Moneris requires merchants to decide approve or decline on that host code, not on the ISO code alone.

• In Moneris' decline table, Base24 code 481 collapses nine ISO codes (05, 50, 51, 57, 58, 62, 65, 80 and 93) into one message. The bank's reason is not recoverable from 481.
• A 500 decline code is usually not a decline at all. Payabli documents its entire 500 band as transport failure, including literal HTTP wrappers such as 502 Bad Gateway and 504 Gateway Time-out, with retry as the documented next step.
• The 400 band is the format and setup layer: 410 invalid merchant configuration, 420 communication error and 440 processor format error, which a resend often clears.
• CardPointe carries a third response status beyond approve and decline: respstat B for a temporary processing issue, used for gateway codes 61 "Line down" and 62 "Timed out".
• Host code 51 is not portable, and neither is response code 51. On First Data North, respcode 51 is labeled simply "Declined" rather than insufficient funds, so the ISO meaning does not carry over.
• For timeouts, check the transaction status before resending. Cybersource separates 150 system error, 151 server timeout and 152 service did not finish, and warns that a blind resend risks a duplicate.

Are 5C and 9G proprietary acquirer codes, and can you retry them?

A log line reading declined 5C or declined 9G carries a Visa network code, not a processor invention. Both codes sit in a retryable category. 5C means issuer rules block the transaction on a card range. 9G means the cardholder set the block themselves, usually in a banking app. Visa introduced both on 11 April 2025 as Category 2 codes, its retryable category.

• Category 2 permits reattempts, and the Visa Rules dated 18 April 2026 set the ceiling at 20 reattempts in 30 days. Braintree and Adyen still publish the older figure of 15, so check which number your retry engine enforces.
• For 9G the block belongs to the customer, so the useful next step is asking them to lift it rather than spending reattempts.
• Checkout.com wraps the network code inside its own: Visa 51 ships as 20051, 5C as 2005C and 9G as 2009G.
• Braintree uses a proprietary 2000-series instead, and one of its codes (2038) maps to Visa codes in two different retry categories at once, so the gateway code cannot recover the network code.
• Worldpay reserves 20 characters for the raw code and warns that third-party acquirers may return five-character values found in no scheme table.
• On Mastercard the paired advice code changes the verdict on one number: 79 with advice code 03 means do not retry, while 79 with advice code 02 may be retried later.

Which codes are retryable, which need a fix first, and which mean stop?

The author decides the verdict, so sort every row by author first and then by verdict. Gateway-layer rows get a configuration change. Host and system rows get an immediate resend. Issuer rows get the retry rule attached to their network code and advice code. The table below maps the strings operators paste into support tickets to those three answers.

Code numbering is per processor. Confirm each mapping against your own gateway's reference before you wire it into a retry rule.

What does a retry cost when the decline was self-inflicted?

It costs a fee, an attempt against the card, and some of the issuing bank's goodwill. Visa charges on any reattempt that follows a Category 1 decline, its never-approve category. Mastercard's card-not-present advice decline fee rose from $0.05 to $0.78 per resubmission on 1 February 2026. That money buys you nothing when the bank never made the decision.

• Visa's system integrity fee applies to any reattempt after a Category 1 decline, and to attempts past the cap for Categories 2 to 4.
• The Visa domestic compliance integrity fee is $0.15 per transaction, and the foreign equivalent rose from $0.23 to $0.38 on 1 May 2026.
• Mastercard charges $0.74 per transaction once there are 10 unsuccessful attempts on the same card within 24 hours.
• The networks define card testing as 10 or more declines in 24 hours, or 20 or more in 30 days, on one card number. A retry loop pointed at a gateway rejection walks into that counter with no bank answer to show for it.
• Stripe recommends a ceiling of eight retries per charge and warns that extra retries can themselves cause declines on legitimate charges.
• A gateway rejection that fired after authorization consumed a real authorization. If the automatic void fails, the hold can sit on the customer's card while your retry adds a second one.
• Schedule shape matters as much as count, which our payment retry strategies guide covers in detail.

How do you normalize decline codes across processors into one number?

You map every processor's dialect onto one set of buckets. Anchor those buckets on the network code, not on the gateway's label. Until then your decline rate is not one number. Many processors leave gateway rejections out of the decline counts and approval rates they report. That omission keeps a whole layer of failures off the dashboard.

• Pagos maps gateway rejections from every connected source into 19 decline reason codes under one category, blocked_by_gateway_or_merchant_rule, and counts them in the aggregated approval rate.
• Expect partial coverage. Spreedly normalizes its failure reason and advice code values only across the gateways in its mapping tables, not across every gateway it supports.
• Adyen concedes the floor in its own list: refusal reason 27, "Declined Non Generic", is the bucket for codes that cannot be mapped reliably.
• Raw strings are a poor key. Adyen warns they differ between schemes and change without notice, and Global Payments tells integrators to build logic on the code rather than the message.
• The dialect problem lives inside single gateways too. On CardPointe, insufficient funds is 51 on TSYS and Vantiv, 116 on First Data Rapid Connect and 7 on FDMS.
• If you run more than one provider, hold the mapping in your own layer rather than in each processor's, which is the measurement half of running multiple payment gateways.

How do you attribute last month's declines by layer in 30 minutes?

Pull one month of failed transactions per processor. Split them into the three authors. Price each pile. The gateway pile is configuration work you control this week. The host pile often recovers on a resend. The issuer pile is where the rules in our credit card decline code and issuer decline guides start to apply.

• Export last month's failed transactions per processor with raw response fields switched on, since Adyen's raw acquirer result and Braintree's raw processor response both ship off by default.
• Split every row into three buckets by author: your gateway or fraud layer, the processor host or system, and the bank.
• Count unique declines and strip failed retries out, so one card attempted eight times counts once rather than eight times.
• For every row with no network code, name the rule that fired, because that is your self-inflicted pile.
• Check the gateway pile for a card-code rule rejecting a large volume, or a 3D Secure rule firing in countries that do not require it.
• Sort the host pile by code and resend a sample, since format and connectivity faults often clear on the next attempt.
• For the issuer pile, map each network code to its Visa category or Mastercard advice code before you touch the retry schedule.
• Price the mistake by multiplying reattempts made after a never-approve decline by the fee line on your statement.

Frequently Asked Questions

What does "transaction declined - gateway rejected" mean?

It means your own gateway settings stopped the payment rather than the customer's bank. Braintree lists nine causes for that status, including address verification, card security code, duplicate, risk thresholds and fraud rules. Because the rule is yours, the fix is a configuration change, and a resend of the same transaction usually meets the same rule.

What is the difference between a gateway decline and an issuer decline?

A gateway decline is your configuration refusing the payment, and an issuer decline is the cardholder's bank refusing it. In Stripe the difference is machine-readable: a blocked payment returns not_sent_to_network with no network decline code, while a bank decline returns declined_by_network with a real code such as 54.

What does decline code 51 mean and can I retry it?

Code 51 is the bank saying there is not enough money available, and Visa places it in Category 2, which permits reattempts. The Visa Rules dated 18 April 2026 allow up to 20 reattempts in 30 days. Check first whether your 51 is a network code or a host wrapper such as Moneris 481.

What does "declined by score 1" mean in my gateway log?

It means a fraud score your own rules produced stopped the order before any bank was asked. Cybersource returns reason code 481 when Decision Manager rejects an order, and Adyen refuses under reason 20 when its pre-authorization risk score reaches 100. Retrying the card cannot change a score you configured.

What is a host code versus a response code on a declined transaction?

A response code is the gateway or network value your API returns, and a host code is the raw string from the processing system that answered. PayPal Payflow returns HOSTCODE only when verbosity is set to high, does not normalize it, and tells merchants to ask their processor what the value means.

Why do decline codes differ between payment processors?

Each processor publishes its own numbering on top of the network codes. Checkout.com renders Visa 51 as 20051, Braintree uses a 2000-series, and NMI bands responses by leading digit. On CardPointe, insufficient funds is 51 on TSYS, 116 on First Data Rapid Connect and 7 on FDMS.