Payment Declined Messages Online: Wording That Saves the Sale
Write a payment declined message at checkout that tells shoppers how to fix the problem without giving card testers clues, so failed payments become orders.
Photo: Pixabay
On this page 7 sections
- Why a Generic Payment Declined Message at Checkout Costs Orders
- Soft Decline vs. Hard Decline: Which Ones Are Worth a Retry
- Decline Codes Explained for Merchants: What to Tell the Shopper
- Message Templates for Insufficient Funds, Bank Blocks, and Typos
- Offering an Alternate Payment Method at the Moment of Failure
- What Not to Reveal in a Card Declined Error Message
- Tracking Decline Rates to Find Gateway or Fraud-Filter Problems
Key takeaways
- Sort every decline your store sees into four on-page messages: check your details, bank declined, technical error, and repeated failures.
- Show insufficient funds and a stolen-card decline to the shopper with the same wording. Keep the real response code in your server log.
- Retry a soft decline only after something has changed. Never resubmit a hard decline or route it through a second processor.
- Before you blame the banks for a decline spike, separate your own fraud-filter rejections from issuer declines.
A good payment declined message at checkout gives the shopper one clear thing to do next, such as fixing a typo or approving the charge in a banking app. It does this without explaining the decline in a way that helps a fraudster. A bare "Payment failed" gives no direction, so a buyer who still wants the product goes back to search results and buys it somewhere else.
Fixing this rarely takes new software. Someone needs to sort your gateway's decline codes into a handful of groups and write one plain message for each group.
Why a Generic Payment Declined Message at Checkout Costs Orders
When a shopper submits a card, the authorization request goes from your gateway through the card network to the issuer, which is the shopper's bank. The issuer answers with a response code. Most gateways pass that code back to your store as a raw code, a text label, or both. Many store themes then throw it away and show the same red banner for every failure.
That one banner covers four very different situations:
- The shopper mistyped something. A wrong digit in the card number or an expiration date entered backward.
- The issuer said no. Not enough available credit, a fraud-model block, or a card that isn't enabled for online purchases.
- Your own rules said no. Your gateway's fraud filter, or an address verification (AVS) or security-code (CVV) rule, rejected the payment.
- Something broke. A timeout, an issuer system that was offline, or a gateway error.
The shopper can't tell which one happened. Some decide your site is broken. Others assume their card is the problem and give up. Each situation has a different fix, so each needs different words.
Put a Dollar Figure on Your Own Declines
Industry averages won't tell you what this costs your store. Your own decline report will. Here's a quick way to estimate it:
- Export last month's declined payment attempts from your gateway.
- Remove the ones that are obviously fraud or card testing. They show up as bursts of attempts on many different cards in a short window.
- Count the declines a real shopper could have fixed on the spot, like typos, expiration errors and bank blocks that clear with an app approval.
- Check how many of those shoppers came back and finished an order with the same email address.
- Multiply the shoppers who never came back by your average order value.
The result is the monthly revenue riding on your error wording and retry path. For a store with large tickets, even a handful of saved orders a month pays for an afternoon of copywriting.
Soft Decline vs. Hard Decline: Which Ones Are Worth a Retry
Declines fall into two broad groups, and the group tells you whether a retry makes sense.
A soft decline is temporary or fixable. Typical examples are insufficient funds, an exceeded limit, an issuer that's temporarily unavailable, and many "do not honor" responses. The same card can succeed later, after the shopper corrects something or gets the bank's approval.
A hard decline won't change however often you resubmit. That covers a card reported lost or stolen, a closed account, an invalid card number and a "pick up card" instruction. Retrying these does nothing for your sales. It also draws the card networks' attention to your merchant account.
Keep shopper retries separate from automated ones. When a shopper fixes a typo and clicks Pay again, that's a new, legitimate attempt. Automated retries, where your system resubmits the same card on its own, are mostly a subscription issue. The card networks limit how often a merchant can resubmit a declined card, and going over those limits can lead to network fees. Some declines also come back with an advice code telling you whether a retry has any chance of succeeding. The limits differ by network and get updated, so ask your processor for the current rules in writing before you build any automated retry schedule.
Decline Codes Explained for Merchants: What to Tell the Shopper
Each gateway reports issuer responses its own way. Some show a two-character code, some show a text label, and some show both. Match on the meaning, and check your gateway's response-code documentation for the exact codes it returns.
| Decline reason (as your gateway may label it) | What the bank or system is saying | Retry the same card? | Shopper message group |
|---|---|---|---|
| Do not honor | Declined with no stated reason, often a fraud-model block | Yes, after the shopper contacts the bank | Bank declined |
| Insufficient funds | Not enough available balance or credit | Later, or use another card | Bank declined |
| Expired card | The date has passed or was mistyped | After correcting | Check your details |
| Invalid card number | The number doesn't match an account | After correcting | Check your details |
| CVV or AVS mismatch | The security code or billing address didn't match | After correcting | Check your details |
| Transaction not permitted | The card can't be used for this type of purchase | No, use another card | Bank declined |
| Lost, stolen or pick up card | The card has been reported or flagged for retrieval | Never | Bank declined |
| Suspected fraud | The issuer flagged this transaction | Not without bank contact | Bank declined |
| Issuer unavailable or system error | A technical failure, not a judgment on the card | Yes, after a short wait | Technical error |
| Rejected by your fraud filter | Your own rules blocked it | Depends on the rule | Bank declined |
A stolen card and insufficient funds land in the same message group. That's on purpose, and the fraud section below explains why.
Why "Do Not Honor" Online Is so Common
"Do not honor" is the issuer's catch-all. Online, it often means the bank's fraud model didn't like something about the purchase. Likely triggers include a first purchase at an unfamiliar merchant, an unusual amount, a merchant based in another country, or a card the cardholder has set to block online use. The shopper can usually clear it in a minute by approving an alert in their banking app or calling the number on the back of the card.
You can lower the odds on your side too. Send the full billing address with every authorization, and make sure your billing descriptor matches the store name shoppers know. Adding 3-D Secure authentication gives the issuer more information to approve on. Our breakdown of 3D Secure at checkout and its conversion trade-offs covers when step-up authentication helps and when it only adds friction.
Message Templates for Insufficient Funds, Bank Blocks, and Typos
Four messages cover nearly every case. Show them directly beside the Pay button, not in a banner at the top of the page. On a phone, a shopper who has to scroll to find the error often never sees it. Keep everything the shopper already entered except the fields that truly need re-entering.
Check your details (invalid number, expired card, CVV or AVS mismatch):
We couldn't verify this card. Please check the card number, expiration date, security code and billing ZIP code, then try again.
Name all four fields, even when you know which one failed. The fraud section explains the reason.
Bank declined (insufficient funds, do not honor, not permitted, lost or stolen, suspected fraud, your own filter):
Your bank didn't approve this payment. You can pay with a different card or one of the options below. If you'd like to use this card, check your banking app for an alert or call the number on the back of your card, then try again.
This wording never says "insufficient funds," which spares an honest shopper some embarrassment. It still points to the two fixes that actually work.
Technical error (issuer unavailable, system malfunction, gateway timeout):
We couldn't reach the payment network just now. Please wait a moment and try again.
Add "Your card was not charged" only when your system has confirmed there's no approved authorization. A shopper who sees a pending charge after being told otherwise will email you or open a dispute.
Repeated failures (several failed attempts in one session):
We're having trouble processing payment for this order. Please try a different payment method, or contact us at (your email or phone) and we'll help you finish your order.
That last line earns its place on higher-ticket orders, where one phone call can save a large sale.
Offering an Alternate Payment Method at the Moment of Failure
The best time to show other ways to pay is right after the decline, while the cart is still open. Put your wallet buttons and a "use a different card" option inside the error state, not only at the top of checkout.
A wallet can help even when it draws on the same underlying card. Apple Pay, and Google Pay when the card is tokenized on the device, send a network token and authentication data, so the issuer has more to go on than a typed-in card number. Cards saved to a Google account without device tokenization may still go through as a plain card number. Wallets also can't fix insufficient funds, so the message should invite a different card as well. If you're deciding which buttons belong on your page, compare express checkout buttons like Shop Pay, Apple Pay and PayPal on fees and conversion first.
One thing to avoid: don't push an issuer-declined transaction through a second processor hoping for a different answer. The issuer makes its decision regardless of which processor sends the request, and resubmitting declines that way can break network rules. A backup payment processor is for outages and account holds, not for overriding the bank.
Payment Failed Retry Logic for Renewals
Subscriptions and memberships face the same problem with no checkout page. The "message" is an email or text, and the retry is your billing schedule. Spread soft-decline retries over several days instead of firing them back to back, and stay inside the network retry limits your processor gives you. After a hard decline, stop retrying and send the customer a secure link to update their card. Many renewal declines come from expired or reissued cards, so set up network tokenization for fewer failed renewals before you write a single dunning email.
What Not to Reveal in a Card Declined Error Message
Fraudsters use checkout pages as free card checkers. In a card testing attack, bots run stolen numbers through small purchases to find the cards that still work. Every specific error message hands them information:
- "Card reported stolen" tells the attacker to drop that number and move to the next one.
- "Insufficient funds" confirms the card is live and only needs a cheaper purchase.
- "Security code incorrect," shown on its own, confirms the number and expiration date are good and only the CVV needs guessing.
- An error that names the billing address tells them everything else on the card checked out.
That's why the templates group reasons together. A real shopper still gets a fix they can act on, and an attacker learns almost nothing.
Words won't stop a bot by themselves, so put controls behind the messages. Limit payment attempts per session, email address, IP address and device. After repeated failures, show a CAPTCHA or require 3-D Secure. Never display the raw response code on the page. Do keep the full response code in your server log, along with the AVS and CVV results, because the next step depends on them. For what each address result means, see AVS codes and how fraud tools use them.
Tracking Decline Rates to Find Gateway or Fraud-Filter Problems
Your decline log tells you more than any conversion tool. Review it monthly and slice it a few ways.
Issuer declines vs. your own rejections. If a large share of failed payments come from your fraud filter or AVS rules rather than the bank, your settings may be stricter than your fraud losses justify. Our guide to false declines and how to fix them walks through loosening rules without inviting chargebacks.
Response code trends. A sudden jump in invalid-number or CVV-mismatch declines across many unrelated cards usually means card testing, not a customer problem. A rise in "do not honor" from one bank can point to a descriptor or data issue worth raising with your processor.
Device and browser. When declines cluster on one mobile browser, look for a form bug. Autofill that drops a digit from the ZIP code is a common culprit.
Cross-border cards. Foreign-issued cards often decline at higher rates than domestic ones. Whether that's worth working on depends on how much of your revenue comes from abroad.
If your gateway won't show you response codes at all, that reporting gap is worth closing. MannyPay supports online payment gateways such as Authorize.net and NMI, along with Shopify and WooCommerce integrations, and its e-commerce payment processing includes 3-D Secure authentication.
Start by exporting last quarter's declined transactions with their response codes. Sort each code into the four message groups above, then compare that sorting with what your checkout shows today. If every decline currently gets the same banner, rewriting those four messages is likely the cheapest conversion fix available to you this quarter. If you'd like to talk with a specialist about your gateway and processing setup, request a free quote and a MannyPay specialist will respond within one business day.
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
