Skip to main content

Getting More Payments Approved (Auth Optimization)

TL;DR
  • Baseline first: Compare approval rates by channel, issuer and country. Know yours before optimizing; see Benchmarks for published context
  • Network tokens: Replace stored card numbers; compare approvals with raw PANs on matched payments. See published Visa context
  • Retry logic: Read the decline and advice codes before another attempt. Stolen-card responses mean stop; an expired card needs corrected details or another card
  • 3DS exemptions: Request TRA, low-value, recurring exemptions where you qualify
  • Flag correctly: MIT vs. CIT matters. Wrong flags = higher declines
Customers being declined right now?

If customers are actively telling you their cards won't go through, don't start here - start with the Fix Declining Auth Rates playbook, an hour-by-hour diagnostic for a sudden decline spike. If the problem is customers abandoning checkout (not card declines), see Checkout Conversion. Come back to this page for the longer-term optimization work.

If only subscription renewals are failing, use failed-renewal recovery setup; for an account-wide spike, use Fix Declining Auth Rates.

Match the effort to your size

Under $100K/month? Check your auth rate in your processor dashboard against your own baseline. If it drops, or customers complain, run the Fix Declining Auth Rates playbook to find out why. Start with that before the heavier optimizations below.

$100K-$500K/month? Start with retry logic and 3DS exemptions. Network tokens are worth a look.

Over $500K/month? All of it applies. Recovered payments are real revenue; measure what gets captured.

Your auth rate is the share of attempted card payments that the customer's bank approves, and auth optimization is the work of pushing that share up. More approvals can mean more money. Check what gets captured, at what value and cost.


Most SMBs don't know theirs, and when you ask, they guess high.

Compare your own segments. A drop in approvals is money you're not collecting. Benchmarks has published context, with its scope.

What Matters​

  1. Know your auth rate. Can't fix what you don't measure.
  2. Test network tokens against raw PANs. Visa publishes a comparison. Measure yours by issuer and transaction type.
  3. Retry logic matters. Wrong retries burn issuer trust. Right retries recover revenue.
  4. 3DS is a lever, not just compliance. Used well it improves auth. Used badly it kills conversion.
  5. Issuer declines have patterns. Learn your top decline reasons and fix the fixable ones.

Auth Optimization Topics​


Know Your Auth Rate​

Baseline before you touch anything.

How to Calculate​

Auth Rate = Approved Transactions / Total Attempted Transactions × 100

What's Normal​

SegmentWhat to Compare
E-commerce (US domestic)Your baseline by issuer, device and card brand
Subscription (initial)First-payment approvals, separately from renewals
Subscription (recurring)Renewals and retries by billing cycle
Card-present (CP)Chip, tap and keyed entry separately
International CNPCountry and issuer within the same channel

There's no universal channel target in the public sources checked for Benchmarks. Investigate drops from your own baseline; ask your processor for comparable merchants.

Where to Find It​

Check your processor dashboard. Look for:

  • "Authorization rate" or "Approval rate"
  • Filter by: card brand, card type, geography, transaction type
Ask Your Dev

"Where can I see our overall auth rate? Can I filter by card brand and geography?"


Quick Reference: Decline Types​

TypeExamplesAction
Soft declineInsufficient funds (51), Issuer unavailable (91)Check the specific response and advice; 51 may need customer action, while 91 may be temporary
Hard declineLost card (41), Stolen (43), Expired (54)Stop on lost/stolen responses; get updated expiry details or another card for 54
AmbiguousDo not honor (05)Follow network and processor advice; don't retry a stop instruction. Ask the customer to contact their issuer or use another card

How to handle each one's in optimization tactics.


Scale Callout​

VolumeFocus
Under $100k/moKnow your auth rate. Ensure basic retry logic is sane. Enable 3DS for high-risk only.
$100k-$1M/moMonthly decline code analysis. 3DS exemption strategy. Network token migration.
Over $1M/moIssuer-level optimization. Dedicated auth rate monitoring. A/B test 3DS strategies. Multiple processor routing for auth lift.

Where This Breaks​

  1. International transactions. Cross-border declines are structurally higher. Local acquiring helps, but it's more moving parts.

  2. High-risk MCCs. Some industries have elevated decline rates regardless of optimization. Issuers are more conservative.

  3. New merchants without history. Issuers trust a track record. Until you've got one, you'll see higher declines.


Analyst Layer: Metrics to Track​

MetricWhat It Tells YouTarget
Overall auth rateBaseline healthCompare matched segments with your own baseline
Auth rate by card brandNetwork-specific issuesCompare each brand with its own matched issuer and customer baseline
Auth rate by geographyCross-border frictionCompare countries within the same channel, route and customer mix
Soft vs. hard decline ratioRetry opportunityClassify your decline codes; compare the mix over time
Retry success rateRetry logic effectivenessCompare recovered payments on matched retry-eligible segments
3DS challenge rateFriction levelCompare by issuer, country and device
3DS conversion rateChallenge completionCompare completed challenges on matched segments

Trend Over Snapshot​

Auth rate fluctuates. Track weekly trend, not daily snapshot.

Compare weekly trends on matched segments. Set alerts from your own transaction counts and normal variation; a small daily sample can swing sharply.


Next Steps​

Just starting auth optimization?

  1. Pull your current auth rate from your processor dashboard → Baseline before optimizing
  2. Identify your top 5 decline codes → Focus fixes on highest-impact issues
  3. Check if you're using network tokens → If not, migrate stored cards to tokens

Ready to improve?

  1. Review optimization tactics → Network tokens, retry logic, 3DS
  2. Follow the increase auth rates playbook → Step-by-step optimization
  3. Implement smart retry logic → Recover soft declines without burning issuer trust

Already optimizing?

  1. Set up weekly auth rate monitoring → Track trends, not snapshots
  2. Segment by card brand and geography → Find specific weak spots
  3. Consider multi-processor routing → Route to best-performing processor by issuer

See Also​

Something wrong on this page? Email matt at paymentsandrisk.com and say what needs fixing.