ISO 8583 Response Codes Explained: 00, 05, 51, 54, 91, 96 + Hard vs Soft Declines

Use this guide to interpret ISO 8583-style authorization response codes as buckets (issuer decision vs data vs network) and choose the safest next step without repeated retries.

More banking guides Banking hub Banking code directory

TL;DR

✓ Two-digit response codes are category signals; context determines the fix.
✓ Hard declines (lost/stolen/capture) require issuer action—don’t retry.
✓ Soft declines and processing errors may allow a single clean retry after correction.
✓ Use idempotency/duplicate protection to avoid double charges during timeouts.

Quick Navigation

Symptoms Root Causes Step-by-step fixes What NOT to do If it persists Code directory Related guides & hubs FAQ References

Symptoms / When you see this

✓ Gateway or terminal shows a two-digit response code.
✓ Transactions decline or require issuer referral.
✓ Timeouts or duplicates appear during retries.

Root causes (grouped)

✓ Issuer decisions (risk, account state, limits).
✓ Data and validation problems (format, invalid identifiers).
✓ Network/processor issues (timeouts, switch inoperative, routing).

Step-by-step fixes (safe, prioritized)

✓ Classify the code as issuer decision vs validation vs network.
✓ Retry at most once after correcting inputs and ensuring no duplicate submission.
✓ For issuer referral/capture/lost-stolen patterns, stop and have cardholder contact issuer.
✓ If many cards fail simultaneously, escalate as a processor/network incident.

What NOT to do

✓ Do not spam retries; it can trigger fraud controls and create duplicates.
✓ Do not store sensitive card data beyond compliance scope.
✓ Do not assume “approved” means “settled”; reconcile capture/settlement separately.

If it persists (escalation checklist)

✓ Collect: code, timestamp, amount, entry method, and gateway request/response IDs.
✓ Check processor status and routing.
✓ Escalate with trace data if the issue is widespread.

Code directory within this guide

✓ Response mappings vary slightly by network/processor; pair code + response text + context.

Code	Meaning	Next step

Tip: If your exact code isn’t listed, use the closest hub link above and browse related prefixes or message patterns.

FAQ

What’s the difference between a hard and soft decline?

Hard declines require issuer action (lost/stolen/capture). Soft declines may allow correction and one clean retry.

Can I auto-retry timeouts?

Only with idempotency/duplicate protection; otherwise you risk double charges.

Why do issuers return generic codes like 05?

Issuers often do not disclose detailed reasons through response codes; risk and policy decisions are internal.

What if the same card works elsewhere?

Merchant category, routing, and risk scoring can change outcomes. Validate your inputs and try a different method if needed.

Does code 00 guarantee payment?

It indicates authorization approval, not final settlement. Confirm capture and settlement status.

What’s the safest retry strategy?

Fix inputs, retry once, then change method or escalate—and always prevent duplicates.

When is it a processor incident?

When many different cards fail with similar system/routing codes at the same time.

What artifacts help support resolve it fast?

Timestamps, request/response IDs, entry method, and full gateway logs.

References / Notes

✓ Processor response mappings
✓ Issuer guidance and acquirer support
✓ Gateway reconciliation logs