Inside the Issuer's Decision: How Your Transaction Gets Risk-Scored

What data does the issuer actually see in an authorization request?

The issuer sees a compact data packet, not your offer page or your VSL. Every authorization request carries the card number or network token, the amount and currency, the merchant category code, the merchant descriptor, the AVS and CVV match results, an indicator for card-present versus card-not-present, and, where present, a 3-D Secure authentication result. Visa's Merchant Data Standards Manual gives acquirers 25 characters for the merchant name and requires abbreviation rather than truncation when a business name runs long, so even the label on a statement is standardized before the issuer's model touches it.

Tokenized transactions carry more trustworthy data than a raw PAN, which is why network figures on approval rates diverge so sharply. Visa's own fiscal-2022 data across 198 countries reported a 4.6% lift in authorization rates for tokenized card-not-present transactions versus PAN, alongside a 30% reduction in online fraud. Mastercard cites a smaller but still material 2.1% average approval-rate increase for merchants using network tokens, with one processor, Checkout.com, reporting a 10.3-percentage-point jump, though Mastercard's own page did not load at check time, so treat that figure as second-hand until reconfirmed.

How much do AVS and CVV mismatches affect the approval decision?

AVS and CVV mismatches feed the issuer's model as flags, not automatic kill switches, and the exact weight assigned to each is proprietary to every issuing bank. A partial AVS match plus a correct CVV often still authorizes at a large card-issuing bank willing to accept some address risk; the same mismatch at a smaller regional bank running a conservative model can trigger an outright decline. No card network publishes a standard weighting formula for AVS or CVV inside the authorization score, and any percentage figure claiming to quantify one should be treated as a vendor estimate, not a bank-published rule.

When the issuer declines on a mismatch it frequently returns response code 05, Do Not Honor — a Category 4 generic refusal, per Visa's decline categorization, that gives no specific reason. Stripe's own documentation defines the underlying decline as one where 'the card was declined for an unknown reason,' with the only real next step being that the cardholder call the number on the back of the card. That opacity is the practical problem: you can correct a shipping address, but you cannot see which mismatch actually triggered the score.

Do issuers score the merchant, the descriptor, and the MCC separately from the cardholder?

Yes — issuers run a merchant-side risk assessment that sits alongside, not inside, the cardholder's own credit and fraud profile. The merchant category code, the billing descriptor, and the acquiring bank's own risk tier all get evaluated independently of who is holding the card. Visa's Merchant Data Standards Manual makes this explicit: where the merchant name is inconsistent with the MCC, the name must carry extra identifying language, and the manual even permits supplementary text after the name to flag the moment a trial or promotional price converts to the regular subscription rate.

The clearest proof this scoring runs separately from the cardholder sits in dispute tooling. Mastercard's Ethoca Consumer Clarity and Visa's Verifi Order Insight both push merchant name, logo, MCC, item description, order number, authorization code and refund policy into the issuer's own banking app the moment a cardholder queries a charge — data the issuer did not have at authorization but is now folding into how it treats that merchant on the next attempt. A descriptor mismatched to the MCC, or a merchant name a cardholder does not recognize, degrades trust independently of anything about the card itself.

How does prior chargeback history at the same merchant affect future approvals?

Chargeback history at a merchant follows that merchant into every future authorization the issuer scores, because the card networks now measure it formally and continuously. Visa's Acquirer Monitoring Program (VAMP), effective 1 April 2025, tracks a VAMP Ratio of card-not-present fraud reports plus disputes divided by settled transactions, and flags a merchant as Excessive once that ratio clears roughly 220 basis points under the initial thresholds — a bar the fact sheet says drops to 150 basis points across AP, Canada, the EU and the US from 1 April 2026.

That ratio is built from data the issuer itself reports: a TC40 fraud record or a TC15 chargeback filed against a merchant feeds directly into the numerator. Mastercard runs a parallel mechanism — its Excessive Chargeback Merchant tier trips at 100 to 299 monthly chargebacks combined with a 1.50% to 2.99% ratio, calculated one month lagged against the prior month's sales — and fines escalate from nothing in month one to $100,000 or more per month by the twentieth month in the program. None of this is invisible to individual issuing banks; a merchant sitting near these thresholds gets treated more cautiously on ordinary authorizations long before a formal program flag lands.

This is where a widely repeated piece of advice in this niche breaks down. Operators fixate on AVS strings and CVV formatting as if approval rate is won transaction by transaction, but the evidence points the other way: a merchant's aggregate dispute ratio, reported through TC40 and TC15 records, shapes how cautiously an issuer treats every subsequent authorization from that same MID before AVS or CVV ever gets evaluated. Fix the descriptor and the dispute rate, and the per-transaction fields matter far less than most retry-optimization content assumes.

Why do some issuing banks decline an entire merchant almost categorically?

Some issuing banks decline a merchant almost categorically because the risk sits at the vertical, not the transaction. Nutraceuticals, negative-option subscriptions and continuity billing sit on restricted-business lists at the processor level — Stripe's restricted list, for instance, excludes unsafe pseudo-pharmaceuticals and nutraceuticals with harmful claims, and separately bars negative-option marketing and discounted trials with unclear pricing — and issuing banks apply their own, unpublished version of the same logic across an entire MCC or merchant profile rather than case by case.

Visa's own decline categorization explains why some of these declines never get a second look:

• Category 1 — issuer will never approve; codes such as 04, 07, 41 and 43 must never be reattempted.
• Category 2 — issuer cannot approve right now; a temporary condition, worth one retry after it clears.
• Category 3 — issuer cannot approve based on the details submitted; correct the data, then retry.
• Category 4 — a generic refusal such as response code 05, Do Not Honor, with no reason stated.

How do velocity, amount, and time-of-day patterns trigger declines?

Velocity is the fastest way to turn an ordinary decline into a penalized one, because both Visa and Mastercard now charge for excessive retries rather than simply refusing them. Visa caps reattempts at 15 within a rolling 30 days for the same card, amount and currency, and any retry of a Category 1 decline, or any attempt past that 15th try, triggers an excessive-reattempt assessment reported at roughly $0.10 domestic and $0.15 cross-border per attempt.

Mastercard runs a parallel mechanism through its Transaction Processing Excellence program: the Excessive Authorizations fee rose to $0.50 per excess authorization from January 2025, up from $0.10 in 2022, $0.15 in 2023 and $0.30 in 2024, applied once a merchant crosses a threshold number of prior declines on the same card inside a 24-hour window. That threshold itself is reported inconsistently — one source states 10 prior declines, others put it at 20 — so treat the exact number as needing confirmation against a current acquirer bulletin rather than a fixed fact.

Amount and timing interact with all of this through ordinary decline-rate patterns that vary sharply by payment method and by where a transaction sits in the billing lifecycle. Recurly's 2022 analysis of more than 2,200 merchants and 50 million-plus subscribers puts the baseline like this:

The pattern that matters operationally is the gap between the first charge and every charge after it: debit cards decline nearly 1.3 points more often on the initial attempt than on recurring bills, and credit cards are actually at their strongest on the recurring leg. A velocity spike concentrated on first-time transactions is a different problem — and a different fix — than one showing up on month-three rebills.

What is the difference between issuer fraud rules and the processor's own fraud filter?

The processor's fraud filter runs before the transaction ever reaches the issuer, while issuer fraud rules run after, inside a bank's own model the merchant never sees directly. Stripe's documentation splits payment failures into three distinct categories rather than an informal soft-versus-hard split: issuer declines, payments blocked by Stripe's own Radar or Adaptive Acceptance layer, and invalid API calls that never form a valid request at all.

A transaction Radar blocks never generates an authorization request the issuer sees, which means it never touches that bank's own fraud score, positive or negative. A transaction the processor forwards and the issuer declines is a different event entirely, governed by the bank's proprietary rules and reflected back only as a response code such as 05 or 51. Confusing the two layers is the single most common mistake in decline-rate diagnosis: raising your processor's risk tolerance can lift approvals the filter was blocking without moving a single issuer-side score.

3-D Secure sits partly in each layer. Stripe notes the liability shift 'typically applies to payments successfully authenticated using 3DS,' moving fraud-dispute liability to the issuer — but off-session, merchant-initiated charges, which is the entire rebill leg of a continuity offer, do not support 3DS authentication under Stripe's documentation. The shift protects the first charge you can route through a checkout page; it does nothing for the auto-ship charge three weeks later.

What can a merchant actually change to improve issuer scoring?

A merchant cannot see the issuer's model, but several inputs to it are directly controllable, and they compound over time rather than on any single transaction. Sending network tokens instead of raw PANs is the single most evidence-backed lever available: Visa's own fiscal-2022 data shows a 4.6% authorization lift and a 30% fraud reduction from tokenization, and Mastercard reports a smaller but still real average lift of 2.1%.

None of these fixes work on a one-transaction timescale. A tokenization rollout, a descriptor correction or an Order Insight integration changes the data an issuer's model ingests over weeks, and the dispute ratio that most heavily shapes categorical treatment is itself lagged by a month or more on both major networks. Treat issuer-side approval as a metric managed on a rolling basis, not one troubleshot transaction by transaction.

• Match the billing descriptor to the MCC, and add clarifying text — Visa's Merchant Data Standards Manual explicitly permits language flagging the end of a trial or promo period on the first converted charge.
• Correct and resubmit Category 3 declines instead of blind-retrying; retrying a Category 1 decline only accrues excessive-reattempt fees.
• Stay inside Visa's 15-attempts-in-30-days ceiling and below whatever your acquirer reports as Mastercard's TPE threshold, since both are now billed per excess attempt, not just refused.
• Push enrichment data — order number, authorization code, item description — through Verifi Order Insight or Ethoca Consumer Clarity so a cardholder inquiry resolves before it becomes a TC15 or a Mastercard chargeback, since a deflected inquiry never enters the VAMP or ECM ratio.
• Run account-updater services; commonly cited figures, around 30% of cards replaced annually and 60-70% of changes captured by updater services, come from payments vendors rather than network-published research, so read them as industry estimate, not official statistic.

Quick decision checklist

Use this page as a decision aid, not a generic blog post. The practical question is whether the reader needs faster evidence about what is already working in VSL-driven direct response, especially across nutra, supplements, GLP-1, weight loss, blood sugar, and adjacent high-intent health markets.

Daily Intel Service is most relevant when the next decision depends on active market examples: which hook to test, which claim style is risky, which funnel structure is common, which language market is moving, and whether a competitor's creative is likely early, scaling, or already saturated.

• Start with the TL;DR if you need the direct answer.
• Use the table to compare trade-offs quickly.
• Use the FAQ for answer-engine-ready summaries.
• Use the CTA when the decision requires live VSL and ad examples instead of theory.

Daily Intel's coverage advantage

Daily Intel Service is positioned around category-leading variety and actionability: one of the broadest direct-response catalogs of VSLs and ad creatives across blackhat, greyhat, and whitehat advertising patterns, with enough context to understand what the advertiser is doing beyond the visible creative. The practical difference is that members are not just seeing a screenshot; they are seeing the VSL, the ad, the funnel path, the transcript, the UTM context, and the research notes that turn the asset into a decision.

This matters because direct-response affiliates do not operate in one clean category. A weight-loss campaign may use a whitehat compliance ad, a greyhat pre-lander, a more aggressive VSL, and a checkout path designed around upsells and recovery. A useful intelligence platform needs to capture that spectrum instead of pretending every winning campaign looks like a public brand ad.

Blackhat, whitehat, and multilingual signal coverage

Daily Intel tracks patterns across both blackhat-style and whitehat-style campaigns so operators can understand the market without blindly copying risk. Whitehat examples help with durability and compliance review; blackhat and greyhat examples reveal pressure points, hooks, mechanisms, and funnel structures that may be driving spend but require careful adaptation before use.

The catalog is also built for global operators, with VSL and ad references spanning 14+ languages and different local idioms. That is a key advantage for Brazilian, LATAM, European, MENA, Indian, and non-native English affiliates who need to see how the same market desire is translated across cultures instead of only studying US English ads.

How to use the intelligence responsibly

The goal is modeling, not copying. Use Daily Intel to understand structure: hook, mechanism, proof, claim intensity, funnel depth, offer economics, and saturation stage. Then build original creative, review claims, and adapt the angle to the traffic source, country, language, and compliance requirements of the campaign.

A strong workflow compares multiple examples before acting. If the same mechanism appears across several languages, several advertisers, and several funnel variants, it may be a durable market signal. If the example appears only once or depends on an aggressive claim, treat it as a research clue rather than a campaign template.

• Model structure, not protected creative assets.
• Separate whitehat durability from blackhat persuasion pressure.
• Compare US English examples against LATAM, European, and other language variants.
• Use transcripts and funnel notes to build original briefs.
• Keep compliance review separate from market research.

Methodology and source context

Daily Intel pages are written from a research workflow that reviews active VSLs, Meta ad creatives, transcripts, UTMs, funnel paths, checkout steps, upsells, recovery sequences, and compliance-sensitive claim patterns. The goal is to explain observable market behavior, not to provide legal, medical, or platform policy advice.

When the topic touches health claims, platform policy, or GLP-1 market research, validate the observable campaign signals against primary references such as Meta advertising standards, FTC health claims guidance, and Google helpful content guidance. Daily Intel adds the proprietary direct-response layer by mapping how those rules show up in active VSLs, Meta creatives, funnels, transcripts, UTMs, and checkout paths.

For deeper evaluation, continue through Daily Intel compliance and legal disclaimer, Aggressive Claims That Still Pass: The Substantiation Line in Supplement Ads, Vetting an Offer's Enforcement Risk Before You Spend a Dollar, High-Risk Merchant Accounts for Supplements: Who Actually Approves You, Visa's VAMP Explained for Nutra: The Ratio That Gets Your MID Killed, and What is a VSL?. These related Daily Intel pages connect this topic to the relevant methodology, pricing, trust context, comparison path, or niche workflow.