Credit Card Response Codes: Approvals, Declines, and AVS Checks

Credit card response codes are the two- or three-character signals a payment system returns after every card transaction, telling the merchant and the cardholder whether the sale was approved, declined, or blocked by a technical problem. They fall into four practical groups: approvals, soft declines you can often fix and retry, hard declines that mean stop, and technical errors on the processing side. A separate layer of letter codes reports the results of address and security-code checks. Knowing which group a code belongs to tells you what to do next.

Approval Codes

Code 00 is the standard approval across Visa, Mastercard, Discover, and American Express. It means the issuing bank authorized the transaction and reserved the amount against the cardholder’s available credit.¹ Some processing networks return Code 000, which carries the same meaning.²

Code 010 is a partial authorization. The bank approved the sale but for less than the requested amount because the card lacks the full available credit, and the merchant needs to collect the remainder through a second payment method.² Prepaid cards trigger partial approvals more often than revolving credit cards, since their balances deplete rather than reset.

Soft Decline Codes

Soft declines are temporary. The card is still active, and a retry after fixing the underlying issue often works.

Code 05 (Do Not Honor). The issuing bank blocked the charge without a specific reason. This one is the most frustrating for merchants because it offers no diagnostic detail. The cardholder usually needs to call their bank to find out what tripped the block.
Code 51 (Insufficient Funds). The account doesn’t have enough available credit, or the linked checking balance is too low.
Code 54 (Expired Card). The expiration date has passed. Use a different card or request a replacement from the issuer.
Code 65 (Activity Limit Exceeded). The cardholder hit a daily transaction count or spending velocity limit. Waiting or calling the issuer to raise the limit clears it.

Codes 05 and 51 are confirmed across major processing networks as standard soft decline responses.³ The card isn’t canceled. Once the customer addresses the issue, whether that means moving money, verifying identity through a banking app, or waiting for a fraud hold to clear, another attempt can go through.

Hard Decline Codes

Hard declines are permanent for that card on that transaction. Retrying is pointless and, as noted further down, can generate network penalties.

Code 14 (Invalid Card Number). The account number doesn’t match anything in the issuer’s database. Usually a mistyped digit at checkout or a misread encoding.
Code 41 (Lost Card). The cardholder reported the card lost and the issuer deactivated it.
Code 43 (Stolen Card). The card is flagged as stolen. For codes 41 and 43, the merchant should retain the physical card if presented in person and follow the network’s security procedures.
Code 62 (Restricted Card). The card has restrictions blocking this type of transaction, such as geographic limits or merchant category exclusions.³
Code 93 (Violation of Law). The transaction would violate applicable law. This code appears for purchases in categories restricted in certain jurisdictions, such as online gambling in states where it’s prohibited.³

Codes 14, 41, and 43 appear consistently across all major networks.³ The correct response is to ask for a different payment method. Running the same card again counts against retry limits and, on some codes, guarantees a network fee.

Technical Error Codes

Technical errors mean the data didn’t get where it needed to go in the right format. No bank made a credit decision.

Code 13 (Invalid Amount). The amount field is formatted incorrectly, contains a negative value or unreadable symbol, or falls outside the system’s allowed range.⁴
Code 19 (Re-enter Transaction). The system couldn’t process the request and is asking for a fresh attempt. Often a momentary transmission glitch.⁵
Code 30 (Format Error). The message sent to the processor doesn’t match the expected structure. Outdated terminal software or misconfigured gateway settings are common causes.¹
Code 96 (System Malfunction). A system along the processing chain is failing. Almost always temporary and resolves within minutes.

The fix is usually mechanical: re-enter the amount, reboot the terminal, check the connection, or wait and try again. If Code 30 keeps returning, the payment software needs a configuration update rather than another retry.

AVS and CVV Verification Codes

Online and other card-not-present transactions return additional letter codes for address and security-code checks. These aren’t approvals or declines by themselves. They’re fraud-risk signals that sit alongside the main authorization response.

Address Verification Service

AVS compares the billing address the customer entered against what the issuer has on file and returns a single letter.⁶

Y. Full match on street address and ZIP code.
A. Street address matches; ZIP does not.
Z. ZIP matches; street address does not.
N. No match on either.
U. Information unavailable, or the issuer doesn’t support AVS.

A full match suggests the person entering the details has access to the billing statement. An N is a strong fraud signal, though it can also happen when a customer recently moved and hasn’t updated their bank records. Many merchants configure their gateway to auto-decline on N and hold partial matches for manual review.

Card Verification Value

The CVV check verifies the three- or four-digit security code printed on the card.⁷

M. Match.
N. No match.
P. Not processed by the issuer.
U. Issuer doesn’t participate in CVV verification.

A CVV mismatch is one of the strongest fraud indicators available, because the code isn’t stored on the magnetic stripe or chip and doesn’t turn up in most data breaches. Processing a transaction with a CVV mismatch leaves the merchant heavily exposed to chargebacks.

Retry Limits and Network Fees

Continuing to attempt authorizations on a card that has already been declined isn’t just wasted effort. Visa and Mastercard both charge merchants for excessive retries, and the fees stack fast for subscription billing systems.

Visa’s domestic compliance integrity fee is $0.15 per transaction when a merchant runs 20 or more failed attempts on the same card within a 30-day window, or retries a card after a decline code indicating the transaction will never be approved (such as a lost or stolen card code). For cross-border transactions the fee rises to $0.38 as of May 2026.⁸

Mastercard is stricter. Its compliance integrity fee hits $0.74 per transaction after just 10 unsuccessful attempts on the same card within 24 hours. For card-not-present transactions, Mastercard also charges a $0.78 advice decline fee for every resubmission of a decline the network already told the merchant to stop retrying, and a $0.03 per-transaction fee on card-not-present declines for certain reason codes including insufficient funds, security flags, and policy violations.⁸

The practical takeaway for merchants: treat hard declines as final, cap soft-decline retries at a small number of attempts spread over several days, and use account updater services to pull fresh card details when a card expires rather than repeatedly submitting the old number.

If the Card Was Lost or Stolen

When a Code 41 or Code 43 appears, the cardholder’s own financial exposure depends on the card type. The rules for credit cards and debit cards are different, and the credit card rules are more forgiving.

Federal law caps a credit cardholder’s liability for unauthorized charges at $50, regardless of when the loss is reported.⁹ Every major network layers a zero-liability policy on top, so most credit cardholders pay nothing on fraudulent charges. The $50 cap is the statutory backstop for the rare cases where the voluntary policy doesn’t apply.

Debit cards fall under the Electronic Fund Transfer Act, and liability scales with reporting speed: $50 if reported within two business days, up to $500 within 60 days, and potentially unlimited after that.¹⁰ If you use a debit card, monitor the account and report suspicious activity right away.

Merchants who keep trying to authorize a card flagged as lost or stolen face consequences from the networks that range from fines to termination of the processing agreement. Networks treat those attempts as compliance violations, not routine retries.

1
North Developer. Transaction Response Codes
2
Worldpay Support. Payment Transaction Response Codes
3
Stripe. Card Decline Codes: A Complete List and What They Mean
4
CCBill. A Comprehensive List of Credit Card Decline Codes
5
Shift4 Knowledge. Understand Credit Card Decline Codes
6
Chase. AVS and Card Verification Codes
7
USAePay Help. CVV Result Codes
8
TD Bank. Excessive Transaction Attempts, PCN Compliance Integrity Fees and Advice Decline Fees
9
Office of the Law Revision Counsel. United States Code Title 15 – Section 1643
10
Legal Information Institute. Electronic Fund Transfer Act