# Your card was declined and nobody will tell you why. That is deliberate.

URL: https://www.paydude.io/resources/why-declined-cards-dont-tell-you-why
Type: Guide
Published: 2026-09-09 · Updated: 2026-09-09
Summary: Most card declines return a generic "do not honor" code. Why issuers withhold the reason deliberately, and what a merchant can actually do about it.

**A card is declined, and the reason given is "do not honor" — which means nothing at all.** That vagueness is not an oversight. A precise decline reason would hand an attacker the single most useful piece of information there is: whether a stolen card number is live.

## Summary

Generic decline codes are a deliberate security control. A specific reason tells a card tester whether the number works. Only the issuing bank knows the real reason, and it will not tell the merchant. Retrying immediately makes things worse, not better.

## Why detail is dangerous

Consider someone holding a list of stolen card numbers, most of which are already cancelled. Their problem is working out which are still usable, and every decline response is a clue.

**What a specific decline would reveal**

| If the response said… | The attacker learns |
| --- | --- |
| Insufficient funds | The card is live and valid — just try a smaller amount |
| Expired card | The number is real; only the date is wrong |
| Incorrect CVV | The number is real; keep guessing the three digits |
| Do not honor | Nothing |

The last row is the point. A generic decline is worth almost nothing to an attacker, which is precisely why it is the one issuers return.

## What is actually happening

Behind a generic decline the issuing bank has run its own risk model, and it can refuse for reasons that have nothing to do with the account balance.

- **Risk scoring** — the transaction looked unusual for this cardholder.
- **Velocity limits** — too many attempts in too short a window.
- **Geography** — a card usually used in one country, suddenly used in another.
- **Merchant category** — some issuers restrict certain categories on certain products.
- **A breach elsewhere** — the card was flagged after appearing in a compromised dataset.

> **Do not retry immediately:** Repeated attempts on a declined card look exactly like [card testing](https://www.paydude.io/resources/card-testing-attacks) to an issuer's risk model. It lowers your authorization rate across all your traffic, not just the failing transaction. Space retries across days, not seconds.

## What a merchant can actually do

1. **Pass every data field you have** — Address and CVV data give the issuer more to work with, and richer data improves approval rates measurably.
2. **Retry on a different day, not a different minute** — Balance-related declines often clear after a payday. Immediate retries mostly generate more declines.
3. **Tell the customer to contact their bank** — Only the issuer knows the reason and only the issuer can clear it. Saying so plainly is more useful than apologising.
4. **Track your decline codes over time** — Individual declines are opaque; the distribution is not. A rising share of generic declines usually points at your own risk profile rather than at your customers.

## The subscription version of this problem

For recurring billing this is not an inconvenience, it is churn. A renewal declines, nobody is present to try another card, and a customer who never decided to leave stops paying.

That is [involuntary churn](https://www.paydude.io/resources/what-is-involuntary-churn), it is usually 20–40% of total churn, and most of it is recoverable — see the [failed payment revenue calculator](https://www.paydude.io/resources/tools/failed-payment-revenue-calculator) for what it is worth.

## Sources

- ISO 8583 response codes, the standard used for card authorization messaging.
- Card network guidance on decline response handling and retry behaviour.

**Recover the payments that fail** Size what failed payments are costing you. — [Open the calculator](https://www.paydude.io/resources/tools/failed-payment-revenue-calculator)

## Frequently asked questions

### What does 'do not honor' mean?

It is the catch-all decline. The issuing bank refused the transaction and chose not to say why. It can mean suspected fraud, an internal risk rule, a velocity limit, or something about the account the bank will not disclose to a merchant.

### Why will the bank not say why my card was declined?

Because a precise reason is useful to an attacker. Telling a merchant 'insufficient funds' confirms the card is live and valid, which is exactly what someone testing stolen numbers wants to learn. Vagueness is a deliberate security control.

### Why was my card declined when I have money?

Most declines are not about balance. Risk rules, unusual location or merchant category, velocity limits, or a card flagged after a breach elsewhere all produce declines on healthy accounts. The cardholder's bank is the only party that knows.

### What can a merchant do about generic declines?

Not retry immediately — that looks like card testing and lowers your authorization rates. Retry later on a different day, make sure address and CVV data is passed correctly, and tell the customer to contact their bank, because only the issuer can resolve it.