Why Issuers Decline Recurring Payments: How to See the Real Reason

Most declined rebills were never a judgment about your customer. The bank said no for a reason it will not write down. The code your gateway shows you summarizes that silence. This piece covers what the code can tell you, what no software can see, and how the pattern names the reason instead.

Issuers decline recurring payments for balance reasons, policy reasons, stale credentials, and cardholder instructions. The response code names only one of those groups honestly. Visa's rules keep a generic bucket for everything else, so a code that explains nothing still follows the rules. The reason becomes visible when you aggregate outcomes by issuer, by the card's bank identification number (BIN) and by billing cycle.

Why does an issuer decline a recurring payment that worked last month?

Because something changed on the bank's side of the account rather than on yours. Four changes account for most of it. The cardholder placed a stop instruction through their bank. The cardholder blocked the card themselves. The stored credential went stale. Or the issuer retuned its fraud scoring. Each one leaves a different code, and three of the four are visible to you.

1. The customer stopped you at their bank. Visa's Stop Payment Service lets an issuer place a stop instruction against a card-absent transaction at the cardholder's request. It answers with R0 (stop this payment), R1 (stop all future payments) or R3, which reaches the subscriptions that cardholder holds with other businesses. Those three codes tell you whether you lost one charge, one subscription or the whole card-on-file relationship.
2. The customer blocked the card themselves. Where an issuer offers in-app card controls, Visa requires it to decline with code 9G, which reads blocked by cardholder, contact cardholder. A cluster of 9G on one issuer means customers are self-blocking, not that the cards are dead.
3. The stored card went stale. Visa's Category 3 bucket covers 54 (expired card), 55, 82 and N7, and those are the codes that point at your stored data rather than at the bank's judgment. Issuer enrollment in Visa Account Updater is mandatory across six regions, with carve-outs for commercial, prepaid and single-use virtual bank identification numbers (BINs).
4. A cancellation in the bank app is now a network-level block. Visa launched the Visa Recurrent Service on 24 October 2026, and a participating issuer can instruct Visa to block payments on future transactions tied to a recurring order. From 24 April 2027 in Asia Pacific and 23 October 2027 in named Europe markets, issuers must decline those authorizations with R1 or R3.

Your first move is to read the raw network code rather than your gateway's label for it. Our guide to what an issuer decline is covers the mechanics, and this piece is about attribution. Start by exporting a full month of failed rebills with the raw code attached to every attempt.

What does the decline code actually tell you, and what does it hide?

The code tells you which category of refusal the bank picked. It hides the reason behind that pick. Visa's Table 7-2 sorts every decline into four categories. Category 4 is literally all other decline response codes. Stripe's own reference sums up nine separate codes in one sentence: the card was declined for an unknown reason.

Every decline carries two network fields, and most dashboards show one. The network decline code states a condition. The network advice code states what to do next. Mastercard calls its version the Merchant Advice Code (MAC). Stripe added both fields to its interface in December 2024. Stripe normalizes the advice into three values: do_not_try_again, try_again_later and confirm_card_data. Code meanings differ by brand, so read the card's brand before the number.

That is the whole problem in one code. Mastercard's 05 reads the same with MAC 01, MAC 03 or MAC 21 attached. MAC 01 reads new account information available. MAC 03 reads do not try again. MAC 21 reads payment cancellation. So one code carries three instructions: refresh the card, stop permanently, and the customer canceled. Mastercard's code 79 splits the same way. Its code 83 is suspected fraud with MAC 01 or 03, and MAC 02 asks you to retry it later.

Mastercard's advice codes are finer-grained than Visa's four categories. MAC 24 through MAC 30 encode an explicit wait: one hour, 24 hours, then 2, 4, 6, 8 and 10 days. Ignoring that instruction now has a price. Mastercard's card-not-present advice decline fee went from $0.05 per resubmission to $0.78 on 1 February 2026. Our guide to gateway decline codes maps which layer wrote the code you are holding.

Can any software show the issuer's real reason for a decline?

No, and the clearest statement of that limit comes from a processor. Stripe's documentation says issuers classify most declines as generic. Stripe adds that for privacy and security reasons they discuss the specifics of a decline only with their cardholders. Recurring payment decline visibility is a measurement problem, not an extraction problem.

Issuer decline reporting software can still do three things honestly, and each of the three is a measurement job rather than a way to read the bank's reason.

1. It can show the raw response instead of a normalized label. Adyen exposes refusalReasonRaw and refusalCodeRaw, so you see the acquirer's own string, such as 51 : Insufficient funds/over credit limit. It is opt-in in the Customer Area, refusalCodeRaw covers Visa and Mastercard on Adyen's own acquiring, and the text can change without notice.
2. It can carry the advice code next to the decline code. That pairing is what separates refresh the card from stop trying, and it is the field most dashboards drop on the way to a report.
3. It can aggregate outcomes until a pattern is readable. One code on one card says little. The same code concentrating on one issuer's BIN range, rising while that issuer's suspected-fraud declines rise too, indicates the bank changed its decisioning.

So separate what you know from what you are assuming. You know the code, the advice code, the issuer, the BIN and the outcome of every attempt. You do not know which rule inside the bank fired, or whether a human reviewed anything. You assume that a code concentrated on one issuer reflects that issuer's policy rather than your own retry volume. Stripe recommends a maximum of eight retries. Stripe warns that extra attempts can look like fraud, which raises declines on legitimate charges.

How do you find the pattern: by issuer, by BIN, by billing cycle?

You aggregate the same three dimensions every time, in that order. Ixopay's BIN-level analysis puts it plainly: a healthy-looking 92.2% blended approval rate compresses every issuer, card type, country and BIN range into one number. The rest of the book approves at about 94%. A 3% cohort approving 20 points below that leaves the headline rate looking fine.

1. By issuer. Break declines down by issuer and compare each bank's pattern over time. A rise concentrated in one bank's do not honor, next to rising suspected-fraud declines from the same bank, indicates that issuer tightened a fraud rule or a transaction limit.
2. By BIN. A Visa BIN has been an 8-digit identifier since 22 April 2022, and 6 digits for BINs licensed before that date. BIN attributes carry the issuer name, the issuer country and the funding source, and some issuers run systematically higher soft-decline rates on card-not-present traffic.
3. By billing cycle. Insufficient-funds declines spike around the 1st, the 15th and the last day of the month, when rent, utilities and payroll collide in the same 72-hour window. Payroll cycles differ by employer, so one retry window will not fit a whole book.
4. By hour of day. Tracking approval rate by hour shows whether the rate dips at 2am or at the end of the month. Knowing the cycle exists stops your team filing tickets about expected behavior.

Here is the arithmetic on a small book. Say you run Harper Press, with 12,000 monthly rebills charged on the 1st and a blended approval rate of 92.2%. One issuer's BIN range is 3% of attempts, or 360 charges. That range approves at about 74%, and the other 97% of your book approves at 94%. That gap costs about 72 extra failures a month. Closing it would move the headline rate by 0.6 points. The 92.2% and the 20-point gap come from the BIN analysis above. The 12,000 rebills and the cycle date are assumptions.

One counting rule matters more than the dimensions. Analyze declines by card fingerprint, the identifier that stays the same across every attempt on one card, rather than by charge identifier. Repeat attempts on the same card inflate the pattern with your own retries. Reporting the decline reason by issuer and BIN works only once each credential counts once. Our decline diagnostics walkthrough sets out the attribution order to follow.

Which layer should you look at: gateway, billing system, orchestration or analytics?

Each layer holds a different part of the answer, and only one of them aggregates. The gateway holds the raw network fields. Your billing system or customer relationship management (CRM) system holds the customer-facing obligations. Orchestration decides which acquirer sees the retry. The analytics layer forms the per-issuer and per-BIN patterns, because it is the only layer that keeps every attempt.

• Gateway. It is the only place the raw fields exist, and the only place they get lost. Adyen maps scheme-specific responses to a refused result and keeps the untranslated original in additionalData, and its reason 27 reads declined non generic for responses it cannot map reliably.
• Billing system or CRM. When a merchant-initiated stored-credential authorization is declined, Visa requires written notice to the cardholder and at least 7 calendar days to pay another way. That obligation lives here, not in the gateway.
• Orchestration. Routing already picks an acquirer per transaction from the BIN range and the issuer relationship, so the dimensions you report on are production inputs too. Changing a stored-credential indicator changes both the issuer's treatment and your cohort definitions at once.
• Analytics. This is where decline codes, issuers, BINs, gateways and billing cycles get joined, and where failed payment recovery gets its targets. Cross-processor comparison needs normalized decline reasons and one authoritative BIN reference, because processors expose BIN data at different depths and refresh it on different schedules.

Pick the layer by the question you are asking. The gateway answers what came back on one attempt. The analytics layer answers which issuers it came back from, across the 20 attempts in 30 days that Visa allows on a retryable decline.

What do you do differently for a soft decline versus a hard decline?

A soft decline is the bank saying not now. A hard decline is the bank saying not this card. Soft declines run at 80% to 90% of payment failures in subscription portfolios. 61.2% of recoveries land in the first seven days after a failure. Hard declines carry a rule instead of a schedule: after a Visa Category 1 code you must not resubmit for that credential.

• Soft: schedule it, do not hammer it. Visa permits up to 20 attempts in 30 days on Categories 2, 3 and 4, while Stripe recommends a maximum of eight retries and one subscription vendor caps attempts at 4 to 6. The networks count per card, so splitting retries across processors does not reset the counter.
• Soft with an advice code: follow the clock. MAC 24 means retry after one hour, MAC 25 after 24 hours, and MAC 30 after 10 days. Retrying a MAC 25 decline after an hour ignores an instruction the network already gave you.
• Hard: stop and re-collect. Category 1 includes 46 (closed account), 57 (transaction not permitted to cardholder) and the R0, R1 and R3 stop codes, and the issuer must keep sending the same code afterwards. Visa's domestic compliance integrity fee is $0.15 per transaction and applies from the first retry after a never-approve code.
• Data quality: refresh it, do not retry it. Category 3 codes point at your stored data. Visa says Account Updater reduces declines for eight authorization response codes, including invalid account number, closed account and expired card, and Mastercard reports 3.8x higher approvals when merchants use credentials from its Automatic Billing Updater.
• Authentication: bring the customer back. An authentication soft decline on an off-session rebill returns the same code on retry, so the path is a session with the customer rather than a wait.

Classification comes before cadence. Our soft decline versus hard decline guide draws the line code by code, and smart retry scheduling covers the timing. The order matters because retrying a hard decline buys a fee. Visa charges $0.15 per transaction once one card takes 20 or more failed attempts in 30 days. Mastercard's counter fires at 10 unsuccessful attempts on the same card within 24 hours.

How do you prove a fix changed issuer behavior rather than mix?

You randomize concurrently instead of comparing last month with this month. The formal name for the trap is a mix effect. A mix effect can move a summary number in the opposite direction from every segment inside it. United States median weekly wages rose 0.9% from 2000 to 2013 while all four education segments fell. That happened purely because the segment weights shifted.

1. Split traffic, not time. Stripe tests its authorization features by randomizing eligible volume into two equal groups over 30 days, a control on existing settings and a treatment with the new ones.
2. Read it 7 days late. Stripe reports results at day 37 rather than day 30, because payments that failed inside the window get retried and approved after it, and the first week of data moves around as retries land.
3. Pin the denominator first. Stripe scores deduplicated success rates, grouping every retry of one payment and counting only the final outcome. Gross and net acceptance on identical data can differ by 6.5 points, 91.44% against 97.9%.
4. Respect the power math. At an even 50/50 split, roughly 80,000 sessions are needed to detect a 1 percentage point change at 5% significance. That is why a single issuer or BIN cell rarely reaches significance on its own.
5. Accept what cannot be split. Stripe runs card account updater on 100% of card-not-present volume in both arms, so the test never measures its effect and you have to estimate it by attribution instead.
6. Check the calendar for rule changes. Visa stopped issuers answering account verifications with code 51 on 24 October 2026, and added code Z5 for a valid account with a balance too low. A code-mix comparison straddling that date is partly measuring a rule change rather than your work.

Price the fee side into any retry experiment as well. Visa's cross-border noncompliance fee rose from $0.15 to $0.25 per attempt on 25 April 2026, alongside $0.10 domestically. A net-revenue comparison that spans that date is confounded by pricing rather than by issuer behavior.

1. Export 30 days of failed rebills with the raw network decline code and the network advice code on every attempt.
2. Count by card fingerprint rather than by charge identifier, so your own retries do not inflate the pattern.
3. Group the failures by issuer, then by 8-digit BIN, then by the day of the billing cycle.
4. Split the Category 1 stop codes (R0, R1, R3, 46, 57) out of the retry population before you measure anything.
5. Route Category 3 codes (54, 55, 82, 6P, N7) to a credential refresh instead of a retry.
6. Check whether the advice code already names a wait, from MAC 24 at one hour to MAC 30 at 10 days.
7. Keep attempts well under the 20-in-30-days ceiling, and compare your count with your acquirer's written fee schedule.
8. Prove any change with a concurrent split test read at day 37, not with a month-over-month comparison.

Frequently Asked Questions