Soft Declines vs Hard Declines: What the Response Code Is Telling You

What separates a soft decline from a hard decline at the issuer?

A hard decline signals the issuer will never approve the transaction as submitted; a soft decline flags a temporary or correctable problem worth retrying. Visa sorts every response into four categories that map cleanly onto this split, per CardPointe's summary of Visa's decline rules: Category 1 codes the issuer will never approve, Category 2 codes the issuer cannot approve right now, Category 3 codes needing corrected data before a retry, and Category 4 generic refusals. Only Category 1 is a true hard decline in the legal-risk sense; the rest are soft, with varying odds of success on retry.

The distinction matters beyond conversion math. Visa caps reattempts at 15 within a rolling 30 days for the same card, amount and currency. Any retry of a Category 1 decline, or any attempt past that 15th try for Categories 2 through 4, triggers an excessive-reattempt fee reported at $0.10 domestically and $0.15 cross-border, per CardPointe's compliance documentation. Treating every decline as retriable is not a growth hack; it is a metered cost.

Which decline codes are permanently non-retryable under card brand rules?

Four Visa codes should never be resubmitted: 04, 07, 41 and 43, the Category 1 refusals covering pick-up-card, lost-card and stolen-card conditions. That specific code-to-category mapping comes from Retries.com's breakdown of Visa's decline categories rather than a Visa-published list, so treat it as directional and confirm it against your own processor's documentation before wiring it into cascade logic.

Because Visa's reattempt cap is card-specific rather than code-specific, routing a Category 1 decline into a retry engine burns through the 15-in-30 allowance meant for softer categories, then pays the excessive-reattempt fee for a second refusal that was never coming. The fix is a hard stop the moment a response lands in that bucket, before any cascade logic runs at all.

What does 'do not honor' actually mean and why is it so common?

'Do not honor' is Visa response code 05, and it means the issuer is refusing the transaction without stating why. It sits in Category 4, a generic refusal that stays inside the standard 15-attempts-per-30-days retry window rather than the permanent block that applies to true Category 1 codes, per Retries.com's category breakdown — a mapping worth verifying against Visa's own materials before it drives production logic.

Stripe's decline-code reference defines the equivalent do_not_honor status even more starkly: the card was declined for an unknown reason, and the only documented next step is for the customer to contact their own issuer. That vagueness is deliberate. Issuers use code 05 as a catch-all so they never have to disclose the internal fraud model, risk score or account rule that actually triggered the refusal.

For a continuity offer, a rising share of 05s against an otherwise stable decline rate usually signals that the issuer's risk models have started flagging the merchant descriptor or the billing pattern itself. It rarely means individual cardholders simply ran short on funds.

How do issuer-generated declines differ from processor or gateway declines?

Issuer declines come from the cardholder's bank after the transaction reaches the card network; processor and gateway declines happen before it ever gets that far. Stripe's own documentation splits failures into three buckets instead of a simple soft-versus-hard split: issuer declines, payments blocked by its own Radar or Adaptive Acceptance risk tools, and invalid API calls. Only the first category sits genuinely outside the merchant's control.

A gateway decline for a malformed CVV or a wrong-length card number is fixable at the point of capture, since better field validation stops it before submission. A Radar or Adaptive Acceptance block is the processor's own risk engine refusing to forward the charge at all, so the issuer never even sees it and no card-network retry rule applies; the fix is adjusting risk thresholds, not resubmitting.

Which declines indicate fraud scoring rather than funds availability?

Stolen-card and lost-card declines are the clearest fraud signal any decline log produces, and Stripe instructs merchants never to show either code to the buyer directly. Both should render as a generic decline instead, per Stripe's own decline-code documentation. Surfacing the real reason tells whoever is running the card that the fraud check caught them, which just sends the same card to test against a different merchant next.

Mastercard's Merchant Advice Code carries the same signal at the network level. MAC 03 flags a closed or fraudulent account and MAC 21 flags a cardholder who already cancelled the billing agreement, each reported to carry a $0.03 fee on the declined transaction, according to Merchant Cost Consulting's read of Mastercard's fee schedule. From January 2026 that fee is reported to extend to every declined transaction carrying those codes, not only retry attempts, which means simply re-presenting a cancelled subscriber's card for another billing cycle carries a price tag before you even decide whether to retry it — a cost brute-force dunning cascades in this niche routinely ignore.

How should each decline category be routed in a cascade?

Route by category, not by instinct. Category 1 declines and fraud-flagged codes such as stolen or lost card should exit the payment flow entirely and never re-enter a retry queue on any processor. Cascading a hard decline to a second MID does not change the issuer's answer, since the card itself is the constant and the acquirer is not, and it invites the kind of multiple-MID scrutiny that Mastercard's Scam Merchant Monitoring Program and Visa's dispute-monitoring rules were built to catch.

Category 2 and 3 declines, covering temporary holds, insufficient funds or malformed data, belong in a delayed or corrected retry that respects Visa's 15-attempts-in-30-days ceiling per card. Category 4 generics like 'do not honor' deserve a lighter touch than most cascades give them: one or two spaced retries, not three attempts in immediate succession, which reads as card testing to the issuer's own fraud models.

Network tokenization changes the math upstream of all this routing. Visa's own data puts tokenized card-not-present transactions at a 4.6% authorization lift over raw PAN submissions across its 2022 fiscal year, alongside a 30% fraud reduction over the same period, per Visa's tokenization research. Mastercard reports a comparable, though less independently confirmed, average lift near 2.1%, a figure that needs checking against Mastercard's own page rather than the secondary citation it currently rests on.

How do I map raw processor response codes to an action?

Start from the category, not the raw two-digit code, because the code alone doesn't say whether resubmitting is safe. The table below maps the signals covered on this page to the action Visa's, Stripe's and Mastercard's own documentation actually supports, rather than the blanket 'try again' advice most decline-code lookup tables default to.

What decline mix suggests a funnel problem rather than a processing problem?

An initial-transaction decline rate well above the roughly 15-20% range implied by aggregated 2025 industry benchmarks for subscription first charges points at the funnel, not the processor, per Payments & Risk's benchmark survey. That range assumes mainstream US domestic card-not-present traffic; a nutraceutical program running materially worse than it on the very first charge is usually buying low-quality or unauthorized cards, not suffering a routing problem.

Recurly's subscription-payments research offers a check on which side of that line you're on: debit cards declined 14.4% of the time on initial charges versus 13.1% on recurring, while credit cards performed best on recurring transactions at a 6.0% decline rate. If your recurring decline rate runs higher than your initial rate, the reverse of Recurly's pattern, that's abnormal, and it usually points to a processing problem — an account updater that isn't running, an expired token, a triggered risk rule — rather than a traffic-quality problem.

A fraud-flagged decline share climbing toward an 8% fraud-to-sales ratio, with at least 10 fraudulent transactions totalling $5,000 in a month, the trigger Stripe's documentation attributes to Mastercard's MATCH excessive-fraud reason code, is an acquisition problem wearing a payments costume. No amount of retry-cascade tuning fixes traffic that was never a legitimate cardholder to begin with.

Quick decision checklist

Use this page as a decision aid, not a generic blog post. The practical question is whether the reader needs faster evidence about what is already working in VSL-driven direct response, especially across nutra, supplements, GLP-1, weight loss, blood sugar, and adjacent high-intent health markets.

Daily Intel Service is most relevant when the next decision depends on active market examples: which hook to test, which claim style is risky, which funnel structure is common, which language market is moving, and whether a competitor's creative is likely early, scaling, or already saturated.

• Start with the TL;DR if you need the direct answer.
• Use the table to compare trade-offs quickly.
• Use the FAQ for answer-engine-ready summaries.
• Use the CTA when the decision requires live VSL and ad examples instead of theory.

Daily Intel's coverage advantage

Daily Intel Service is positioned around category-leading variety and actionability: one of the broadest direct-response catalogs of VSLs and ad creatives across blackhat, greyhat, and whitehat advertising patterns, with enough context to understand what the advertiser is doing beyond the visible creative. The practical difference is that members are not just seeing a screenshot; they are seeing the VSL, the ad, the funnel path, the transcript, the UTM context, and the research notes that turn the asset into a decision.

This matters because direct-response affiliates do not operate in one clean category. A weight-loss campaign may use a whitehat compliance ad, a greyhat pre-lander, a more aggressive VSL, and a checkout path designed around upsells and recovery. A useful intelligence platform needs to capture that spectrum instead of pretending every winning campaign looks like a public brand ad.

Blackhat, whitehat, and multilingual signal coverage

Daily Intel tracks patterns across both blackhat-style and whitehat-style campaigns so operators can understand the market without blindly copying risk. Whitehat examples help with durability and compliance review; blackhat and greyhat examples reveal pressure points, hooks, mechanisms, and funnel structures that may be driving spend but require careful adaptation before use.

The catalog is also built for global operators, with VSL and ad references spanning 14+ languages and different local idioms. That is a key advantage for Brazilian, LATAM, European, MENA, Indian, and non-native English affiliates who need to see how the same market desire is translated across cultures instead of only studying US English ads.

How to use the intelligence responsibly

The goal is modeling, not copying. Use Daily Intel to understand structure: hook, mechanism, proof, claim intensity, funnel depth, offer economics, and saturation stage. Then build original creative, review claims, and adapt the angle to the traffic source, country, language, and compliance requirements of the campaign.

A strong workflow compares multiple examples before acting. If the same mechanism appears across several languages, several advertisers, and several funnel variants, it may be a durable market signal. If the example appears only once or depends on an aggressive claim, treat it as a research clue rather than a campaign template.

• Model structure, not protected creative assets.
• Separate whitehat durability from blackhat persuasion pressure.
• Compare US English examples against LATAM, European, and other language variants.
• Use transcripts and funnel notes to build original briefs.
• Keep compliance review separate from market research.

Methodology and source context

Daily Intel pages are written from a research workflow that reviews active VSLs, Meta ad creatives, transcripts, UTMs, funnel paths, checkout steps, upsells, recovery sequences, and compliance-sensitive claim patterns. The goal is to explain observable market behavior, not to provide legal, medical, or platform policy advice.

When the topic touches health claims, platform policy, or GLP-1 market research, validate the observable campaign signals against primary references such as Meta advertising standards, FTC health claims guidance, and Google helpful content guidance. Daily Intel adds the proprietary direct-response layer by mapping how those rules show up in active VSLs, Meta creatives, funnels, transcripts, UTMs, and checkout paths.

For deeper evaluation, continue through Daily Intel compliance and legal disclaimer, How to Trace the Redirect Chain Behind an Affiliate Ad, Referrer Stripping: How Funnels Hide Their Traffic Source, How to Identify a Cloaking Provider From URL Patterns, How to Identify a Competitor's Tracker From the URL, and What is a VSL?. These related Daily Intel pages connect this topic to the relevant methodology, pricing, trust context, comparison path, or niche workflow.