This explains how a card authorisation works and what makes one fail. It isn't financial advice, it doesn't recommend any bank or card, and it can't tell you why your specific transaction was declined — only your card issuer knows that, and only they can change it. Rules differ by country, by network and by bank. Treat this as the general mechanism.
Who actually declined you
Almost every decline comes from one place: the bank that issued your card. Not the shop, not the card machine, not Visa or Mastercard. The shop asked a question and got a "no" back, and that "no" was generated by a computer at your issuer in roughly the time it takes to blink.
This matters because it determines who can fix it. A cashier retrying the card, or switching from contactless to chip, is not addressing the decision — they're just asking the same computer the same question again. Sometimes that works, which we'll come to. Usually it doesn't, because nothing changed.
There is one meaningful exception. A small share of declines never reach your bank at all: the shop's own payment processor or the merchant's fraud screening can refuse a transaction before it leaves. Online, this is more common than most people realise. It looks identical to you.
The four-second journey of a payment
Understanding the path makes the failure modes obvious, because each hop can say no for its own reasons.
The whole round trip normally completes in one to three seconds. That speed is the reason the decision has to be automated, and automation is the reason it is sometimes wrong.
What actually triggers a decline
In rough order of how often people run into them.
1. Not enough available credit — which is not the same as your balance
This is the biggest single source of confused declines. Your available credit is your limit minus what you've spent and minus every authorisation still being held. A hotel that held a deposit, a car rental, a fuel pump that held a flat amount before knowing what you'd pump — all of those reduce what's available for days, even though the money hasn't actually left. People check their balance, see room, and get declined anyway.
The same applies to debit cards with pending holds against a current account.
2. The fraud model didn't like the pattern
Your issuer runs every transaction through a scoring model. It looks at the amount, the merchant type, the country, the time, whether the card was physically present, and — crucially — how this compares with your normal behaviour. Things that raise the score:
- A first transaction in a country you don't usually transact in.
- Several transactions in quick succession, especially small ones (this is exactly what card-testing fraud looks like).
- An unusually large amount for you, at a merchant type you've never used.
- An online purchase from a merchant with a poor fraud history.
- A transaction that arrives while a physically distant one is still fresh.
None of these are accusations. The model has no idea who you are; it has a probability. If the probability crosses a threshold, it declines and — usually — sends you a message.
3. Something about the card data didn't match
Online, the merchant sends more than the card number. It typically sends the security code from the back and some part of your billing address. If either fails to match what your bank holds, many issuers decline. This catches a lot of legitimate people who have moved house and never updated the billing address on file.
Also in this family: an expired card, a card that was reissued with a new expiry date, a mistyped digit, and a card that was never activated.
4. A limit you didn't know you had
Beyond the credit limit, cards carry other ceilings: a daily spending limit, a daily cash withdrawal limit, a per-transaction maximum, and a cumulative contactless limit that forces a PIN entry once you've tapped enough times. Hitting the contactless ceiling isn't really a decline — the terminal is asking for the PIN — but it reads as one.
5. The card is restricted, frozen or blocked
Reported lost or stolen, frozen in your banking app (easy to do by accident), blocked pending a security check, or restricted to certain merchant categories. Many cards also block gambling merchants by default, and some block cash-like transactions such as buying currency or crypto.
6. A subscription failed after your card was replaced
Recurring payments store your card number. When your card is replaced, some networks push the new details to merchants automatically and some don't, and merchants have to be signed up for it. The result is a subscription that quietly stops working months later.
7. The 3-D Secure step didn't complete
Online, many transactions route through an extra verification step — a push notification, a code, a bank app prompt. If that step times out, or the app doesn't load, or you close the window, the transaction fails. From your side it can look like the payment was refused, when actually it was abandoned.
8. Something was simply broken
Issuer systems go down. Networks have outages. A chip can be dirty or worn. In these cases the response code says "try again later" rather than "no", which brings us to a genuinely useful distinction.
Why the shop is told nothing
The merchant receives a short response code. Some of those codes are specific — expired card, exceeds withdrawal limit — but a large share of real-world declines come back as the deliberately vague one that means, roughly, refused, no reason given.
This vagueness is intentional and it protects you. If the terminal displayed "insufficient funds — you have £14 left" or "declined by fraud model", then anyone testing stolen cards would learn exactly which cards are live, which have room on them, and which fraud rules to route around. So the network gives the merchant enough to act on and nothing more.
The practical consequence: asking the cashier why is pointless, and it isn't their fault they can't say. The information exists only at your bank, which is why the app or a phone call is the actual answer.
Soft declines and hard declines
The payments industry splits declines into two families, and knowing which one you hit tells you whether retrying is sensible.
A practical rule that follows from this: if the first retry fails identically, stop. Three or four rapid attempts on the same card is the exact signature of someone testing a stolen number, and some issuers will tighten on your card because of it.
Why online declines feel different
In a shop, the card is physically present, the chip proves it's genuine, and your bank carries the loss if it turns out to be fraud. Online, none of that is true. The merchant is often the one left holding the loss, so online transactions get screened twice — once by the merchant's own fraud system, once by your issuer.
That double screening is why the same card can work at a till and fail on a website minutes later, and why a decline online frequently isn't your bank at all. If your banking app shows no declined attempt, the merchant refused it before it ever reached you.
It's also worth knowing that a failed attempt can still place a temporary hold that shows up in your app. It normally falls off by itself. If you retry four times, you may see four holds and a balance that looks alarmingly wrong for a day or two.
What to check, in order
Cheapest checks first.
- Look at your phone. Many issuers send a message the instant they decline, sometimes asking you to confirm the transaction was you. Confirming it often clears the block immediately, and the next attempt goes through.
- Open your banking app and look at available credit, not balance. Then look for pending holds you'd forgotten.
- Check the card isn't frozen. Freeze toggles sit next to other buttons and get pressed by accident.
- Check the expiry date and, online, the billing address on file. An address that's one house move out of date fails silently and forever.
- Check whether the app even recorded a declined attempt. If not, the merchant refused it, and only the merchant can help.
- Try a different card. Not to solve it, but to learn where the problem lives. If a second card also fails at the same merchant, it isn't your bank.
- Call the number on the back of the card. They can see the exact reason. Call the number printed on the card itself, never a number from a message you received about the decline.
A declined payment is a moment scammers actively target, because you're expecting contact from your bank. A text or email that arrives right after a decline, asking you to confirm details or click a link, is a common attack — and the timing is not always a coincidence, since the same fraud attempts that trigger declines often come alongside phishing. Always go to the app you already had, or the number printed on the card. Your bank will never need your full PIN, your password, or a code you received. See how to check whether a site is genuine.
Mistakes that make it worse
- Retrying repeatedly. It rarely helps, it stacks up temporary holds that reduce your available credit further, and it can look like card testing.
- Assuming the shop did something wrong. They almost never did, and they genuinely cannot see the reason.
- Reading the balance instead of the available credit. The most common false conclusion in this whole subject.
- Trusting a message that arrives right after the decline. Covered above, and worth repeating.
- Ignoring a failed subscription. A recurring payment that quietly fails can end a policy, a service or an account, and you often find out at the worst moment.
- Not telling the bank about travel — or assuming you must. Many banks no longer want travel notifications and use your phone's location instead; some still do. Whichever yours is, the setting lives in the app.
Your bank made the decision, in about a second, using a model that has never met you — and the shop was deliberately told almost nothing, because telling them more would help fraudsters. Most real declines come down to available credit being lower than your balance suggests, a fraud model reacting to an unusual pattern, or card data that no longer matches what the bank holds. Check your phone first, your available credit second, and stop retrying after the first failure. The reason exists in exactly one place: your issuer.