A card is declined, and the reason given is "do not honor" — which means nothing at all. That vagueness is not an oversight. A precise decline reason would hand an attacker the single most useful piece of information there is: whether a stolen card number is live.
Why detail is dangerous
Consider someone holding a list of stolen card numbers, most of which are already cancelled. Their problem is working out which are still usable, and every decline response is a clue.
| If the response said… | The attacker learns |
|---|---|
| Insufficient funds | The card is live and valid — just try a smaller amount |
| Expired card | The number is real; only the date is wrong |
| Incorrect CVV | The number is real; keep guessing the three digits |
| Do not honor | Nothing |
The last row is the point. A generic decline is worth almost nothing to an attacker, which is precisely why it is the one issuers return.
What is actually happening
Behind a generic decline the issuing bank has run its own risk model, and it can refuse for reasons that have nothing to do with the account balance.
- Risk scoring — the transaction looked unusual for this cardholder.
- Velocity limits — too many attempts in too short a window.
- Geography — a card usually used in one country, suddenly used in another.
- Merchant category — some issuers restrict certain categories on certain products.
- A breach elsewhere — the card was flagged after appearing in a compromised dataset.
What a merchant can actually do
- Pass every data field you have
Address and CVV data give the issuer more to work with, and richer data improves approval rates measurably.
- Retry on a different day, not a different minute
Balance-related declines often clear after a payday. Immediate retries mostly generate more declines.
- Tell the customer to contact their bank
Only the issuer knows the reason and only the issuer can clear it. Saying so plainly is more useful than apologising.
- Track your decline codes over time
Individual declines are opaque; the distribution is not. A rising share of generic declines usually points at your own risk profile rather than at your customers.
The subscription version of this problem
For recurring billing this is not an inconvenience, it is churn. A renewal declines, nobody is present to try another card, and a customer who never decided to leave stops paying.
That is involuntary churn, it is usually 20–40% of total churn, and most of it is recoverable — see the failed payment revenue calculator for what it is worth.
Sources
- ISO 8583 response codes, the standard used for card authorization messaging.
- Card network guidance on decline response handling and retry behaviour.
GOOD QUESTIONS
Frequently asked
What does 'do not honor' mean?+
It is the catch-all decline. The issuing bank refused the transaction and chose not to say why. It can mean suspected fraud, an internal risk rule, a velocity limit, or something about the account the bank will not disclose to a merchant.
Why will the bank not say why my card was declined?+
Because a precise reason is useful to an attacker. Telling a merchant 'insufficient funds' confirms the card is live and valid, which is exactly what someone testing stolen numbers wants to learn. Vagueness is a deliberate security control.
Why was my card declined when I have money?+
Most declines are not about balance. Risk rules, unusual location or merchant category, velocity limits, or a card flagged after a breach elsewhere all produce declines on healthy accounts. The cardholder's bank is the only party that knows.
What can a merchant do about generic declines?+
Not retry immediately — that looks like card testing and lowers your authorization rates. Retry later on a different day, make sure address and CVV data is passed correctly, and tell the customer to contact their bank, because only the issuer can resolve it.