Why Recurring Card Payments Decline and How to Recover Them

Why do recurring payments decline?

When you charge a saved card, your processor sends an authorization request to the issuer. The issuer's systems weigh signals such as account balance, spending patterns and card data like the expiration date, as Stripe's documentation on declines (opens in a new tab) describes, then approve or decline. A decline comes back with a code giving the reason, such as insufficient funds, an expired card or a card reported lost or stolen. In recurring billing the customer is not present, so nobody is at checkout to try another card.

Soft and hard declines: what is the difference?

A hard decline means the issuer has rejected the transaction and it cannot be retried with the same card. Stripe's retry documentation (opens in a new tab) lists hard decline codes including incorrect number, lost card, stolen card, pickup card and revoked authorization. Declines that may succeed later are often called soft declines. Insufficient funds is the classic case: Visa's rules treat it as a decline the issuer cannot approve at this time, which can be reattempted within limits.

Visa formalizes this. A September 2020 rules update (opens in a new tab) explains that response code categories were introduced in April 2020 and updated effective 17 April 2021. They are Category 1 (issuer will never approve), Category 2 (issuer cannot approve at this time), Category 3 (data quality) and Category 4 (generic response codes, meaning any code not listed in Categories 1 to 3, as TabaPay's documentation (opens in a new tab) puts it). That 2020 notice stated a Category 2 limit of 15 reattempts in 30 days. The limit has since risen: as of May 2026, PayPal's merchant guidance (opens in a new tab) states that Visa allows 20 retries in 30 days on Categories 2 to 4 and none on Category 1, and TabaPay gives the same figure.

The table maps common decline types to the closest category; the actual response code is what counts.

Limits and fees change, so confirm current figures with your processor. Other networks, including Mastercard, publish their own retry limits.

How do account updaters and network tokens prevent declines?

An account updater sends refreshed card details to merchants who store cards. Visa Account Updater (opens in a new tab) exchanges updates between participating issuers and acquirers. Merchants query it through their acquirer, the bank that processes their card sales, and get back new account numbers or expiration dates, closed-account notices or advice to contact the cardholder. Stripe's page on automatic card updates (opens in a new tab) notes that updates depend on issuer participation: support is wide in the United States across the major card brands but varies by country, so keep a self-service update option for the cards it misses.

A network token replaces the card number with a substitute value from the card network. Stripe describes network tokens (opens in a new tab) as a nonsensitive substitute for card numbers that can keep working when the underlying card details change. Because a token is not the real number, it also limits what is exposed if stored data leaks; see the PCI compliance overview.

Ask your processor or payment gateway whether updater and token services are turned on for your account.

When and how should you retry?

Retry only declines that can change, and space the attempts, since an account that is short today may be funded after payday. As of October 2026, Stripe's retry settings (opens in a new tab) let a business retry within windows from one week to two months, with a recommended default of 8 tries within 2 weeks, and Stripe does not run scheduled retries after a hard decline until a new payment method is on file. Whatever tool you use, stay under the network's cap; for Visa, PayPal and TabaPay guidance gave it as 20 reattempts in 30 days as of 2026.

Example (illustrative numbers): a gym bills 400 members on the 1st and 30 payments decline. Six are lost or stolen cards, so it does not retry and emails those members at once. Eight are expired cards; the account updater supplies new details for five, which then go through, and the other three members get the self-update link. Sixteen are insufficient funds, retried on the 4th and the 8th.

Dunning and customer self-update

Dunning is the sequence of messages sent after a failed payment. Keep it short and specific: say the payment failed, give the date of the next attempt, and link to a secure page where the customer can update their card. For hard declines, send that link in the first message, because no retry will work.

What does the stored credential framework require?

A stored credential is card information, including a token, that a merchant keeps to process future payments. Visa's stored credential framework (opens in a new tab) separates:

• Cardholder-initiated transactions (CIT): the customer takes part, such as checking out with a saved card.
• Merchant-initiated transactions (MIT): the merchant charges without the customer present, under a prior agreement. Recurring, installment and unscheduled top-up payments fall here.

Visa's 2017 guide, with requirements effective October 2017, says merchants must disclose how a stored card will be used, get the cardholder's consent, and flag the first and later transactions with the correct indicators. Visa says identifying these transactions results in higher approval rates. The same guide also describes a narrow "resubmission" case: retrying after an insufficient-funds decline when the goods or services were already delivered. Your processor or gateway sets the indicators; your part is consent and a clear agreement covering amount, frequency and cancellation.

How is a decline different from a chargeback?

A decline happens before any money moves; the issuer simply says no. A chargeback happens after a payment settles, when the cardholder disputes it and the money is pulled back. The chargebacks explainer covers that process. The two connect: Visa's framework says not to charge a stored card beyond the agreed term or after the cardholder cancels under the agreed policy, and doing so invites disputes.