# Fix Declining Auth Rates (Playbook)
Source: https://paymentsandrisk.com/docs/playbooks/fix-declining-auth-rates

Last updated 23 October 2026.

TL;DR

-   **Hour 1**: confirm the drop is real and isn't a data artifact, isolate the segment (BIN, geo, method), pull decline codes. Half the time that's where it ends
-   **Hour 2-4**: Match pattern. Issuer\-specific? All traffic? Soft declines (51)? Hard declines (14, 54)? 3DS\-related?
-   **Common fixes**: roll back the aggressive rule, restart the card updater, fix the 3DS config, or get your processor to do issuer outreach. It's usually the first one
-   **Set alerts**: trial the starting settings below, then adjust for normal variation, payment counts and who will investigate
-   See [Auth Optimization](https://paymentsandrisk.com/docs/payments/auth-optimization/) for proactive improvements

Auth rate dropped 2+ points in a week? Don't panic. This playbook helps you diagnose the cause in hours, not days. Most drops come from a small number of root causes. Find yours.

_Timeline: 1-3 days to diagnose, 1-2 weeks to fix._

## Workflow Overview

```mermaid
flowchart LR
    A[<b>HOUR 1</b><br/>Identify Scope] --> B[<b>HOUR 2-4</b><br/>Root Cause] --> C[<b>DAY 2-3</b><br/>Implement] --> D[<b>ONGOING</b><br/>Monitor]

    style A fill:#b42318,color:#fff
    style B fill:#5e4b8b,color:#fff
    style C fill:#9a5b00,color:#fff
    style D fill:#1f6f4a,color:#fff
```

| Phase | Key Tasks |
| --- | --- |
| **Identify Scope** | Confirm drop is real, isolate segment (BIN, geo, method), check decline codes |
| **Root Cause** | Check scenarios, match symptoms to likely causes |
| **Implement** | Quick fixes (same day), medium fixes (this week), plan longer fixes |
| **Monitor** | Set up alerts, track recovery, document learnings |

Pull four things before you start. Your processor dashboard, auth rate broken out by segment, the decline code breakdown, and the timestamp of when it started dropping. Without that you're guessing, and you'll guess wrong.

## Trigger Criteria

Use these suggested starting alerts, then tune them to your traffic and normal variation:

-   Auth rate dropped more than 1 percentage point week-over-week
-   Auth rate dropped more than 0.5 percentage points day-over-day
-   You're suddenly below your historical baseline
-   Customer complaints about declined payments spike

* * *

## Hour 1: Identify the Scope

### Step 1: Confirm the Drop Is Real

Rule out data issues first:

-   Check total transaction volume (did volume spike or drop?)
-   Verify reporting isn't lagged or broken
-   Compare multiple data sources if available

**Checkpoint:** Confirmed real auth rate decline, not data artifact.

### Step 2: Isolate the Segment

Break down auth rate by:

| Segment | Check For |
| --- | --- |
| **Card brand** | Visa vs MC vs Amex vs Discover |
| **BIN/Issuer** | Specific issuer having issues |
| **Geography** | US vs international; specific countries |
| **Payment method** | Cards vs wallets vs ACH |
| **Transaction type** | CP vs CNP; one-time vs recurring |
| **3DS status** | 3DS vs non-3DS |
| **Time of day** | Certain hours affected |

**Checkpoint:** Identified whether drop is global or isolated to specific segment.

### Step 3: Check Decline Codes

Pull decline code distribution:

| Code | Meaning | If Spiking |
| --- | --- | --- |
| 05 | Do not honor | Issuer-side issue or fraud signal |
| 51 | Insufficient funds | Customer mix changed |
| 14 | Invalid card number | Tokenization or integration issue |
| 54 | Expired card | Card updater not running |
| 57 | Transaction not permitted | MCC or geo restriction |
| 65 | Velocity exceeded | Your rules or issuer rules |

**Checkpoint:** Identified which decline codes increased.

* * *

## Hour 2-4: Root Cause Analysis

### Scenario A: Specific Issuer Declining More

**Symptoms:**

-   One or few issuers (BINs) show major decline increase
-   Other issuers unchanged

**Likely causes:**

-   Issuer fraud model updated
-   Issuer technical issues
-   Your fraud rate with that issuer triggered blocks

**Actions:**

1.  Check if issuer has known outage (check DownDetector, X/Twitter)
2.  Review your fraud/chargeback rate with that issuer
3.  Contact processor to check for issuer advisories
4.  If persistent, escalate through network channels

### Scenario B: All Traffic Declining More

**Symptoms:**

-   Decline increase across all segments
-   Happened suddenly at specific time

**Likely causes:**

-   Integration change deployed
-   Processor/gateway issue
-   New fraud rule too aggressive
-   3DS configuration changed

**Actions:**

1.  Check recent code deploys (was anything pushed?)
2.  Check processor status page
3.  Review fraud rule changes in last 48 hours
4.  Check 3DS challenge rate (did it spike?)

### Scenario C: Soft Declines (05, 51) Increasing

**Symptoms:**

-   "Do not honor" or "Insufficient funds" codes up
-   Customer quality may have changed

**Likely causes:**

-   Traffic source changed (new marketing channel)
-   Time of month (end of month, funds low)
-   Fraud testing attacks (generates declines)

**Actions:**

1.  Compare traffic sources week-over-week
2.  Check for velocity spikes (fraud testing?)
3.  Implement retry logic if not already present
4.  Review if new marketing is bringing lower-quality leads

### Scenario D: Hard Declines (14, 54) Increasing

**Symptoms:**

-   "Invalid card" or "Expired card" codes up
-   Often recurring billing affected

**Likely causes:**

-   Card updater stopped working
-   Token migration issue
-   Integration sending wrong data

**Actions:**

1.  Verify card updater is running (check processor dashboard)
2.  Check tokenization integrity
3.  Review integration logs for malformed requests

### Scenario E: 3DS-Related Decline

**Symptoms:**

-   Non-3DS auth rate stable; 3DS auth rate dropped
-   Challenge rate increased
-   Frictionless rate decreased

**Likely causes:**

-   3DS provider issue
-   Risk threshold changed
-   Issuer ACS issues

**Actions:**

1.  Check 3DS provider status
2.  Review 3DS risk settings (did thresholds change?)
3.  Compare challenge vs frictionless rates
4.  Test 3DS flow manually

* * *

## Day 2-3: Implement Fixes

### Quick Fixes (Same Day)

| Issue | Fix |
| --- | --- |
| Too-aggressive fraud rule | Roll back or loosen in shadow mode |
| Integration bug | Hotfix and deploy |
| Card updater stopped | Re-enable or restart |
| 3DS misconfigured | Adjust thresholds |

### Medium Fixes (This Week)

| Issue | Fix |
| --- | --- |
| Issuer blocking you | Contact processor for issuer outreach |
| Retry logic missing | Implement smart retry for soft declines |
| Bad traffic source | Pause channel, investigate |

### Longer Fixes (Ongoing)

| Issue | Fix |
| --- | --- |
| High fraud rate causing blocks | Improve fraud prevention |
| Need network tokens | Implement tokenization project |
| Need better 3DS | Tune risk model, consider new provider |

* * *

## Monitoring After Fix

The table gives example starting alerts, not industry limits. Compare the same issuer, country and payment type. Choose a window with enough attempts to distinguish a change from one decline, and test whether the alert catches known incidents without flooding the inbox:

| Alert | Threshold |
| --- | --- |
| Auth rate drop | More than 0.5pp below 7-day average |
| Specific decline code spike | More than 2x normal volume |
| 3DS challenge rate | More than 5pp above baseline |
| Single issuer decline rate | More than 10pp above baseline |

* * *

## Success Criteria

You're done when:

-   [ ]  Root cause identified and documented
-   [ ]  Fix implemented or escalation in progress
-   [ ]  Auth rate recovering toward baseline
-   [ ]  Monitoring alerts configured to catch recurrence

* * *

## Scale Callout

| Volume | Approach |
| --- | --- |
| **Under $100k/mo** | Focus on biggest decline code first; may not have segment granularity |
| **$100k-$1M/mo** | Full segment analysis; processor should help with issuer outreach |
| **Over $1M/mo** | Real-time monitoring required; dedicated processor contact; issuer-level optimization |

* * *

## Where This Breaks

-   **No segment-level data.** Ask processor for detailed reporting; you need this visibility.
-   **Can't identify deploy timing.** Correlate with engineering; need deploy timestamps.
-   **Processor says "issuer issue" but won't help.** Escalate; ask for issuer outreach or network escalation.
-   **Auth rate keeps bouncing.** That's usually A/B tests, bot traffic or something external. It's a longer investigation.
-   **Multiple issues at once.** Fix one at a time and validate, or you won't know which fix worked.

* * *

## Next Steps

After stabilizing auth rates:

1.  **Document the root cause**: Add to your runbook for faster diagnosis next time
2.  **Set up alerts**: Configure [monitoring](https://paymentsandrisk.com/docs/operations/alerts-configuration/) to catch future drops early
3.  **Optimize proactively**: Move to [Increase Auth Rates](https://paymentsandrisk.com/docs/playbooks/increase-auth-rates/) playbook
4.  **Review quarterly**: Schedule regular auth rate reviews to catch gradual declines

* * *

## Related

-   [Auth Optimization](https://paymentsandrisk.com/docs/payments/auth-optimization/) - Proactive improvements
-   [Decline Codes Reference](https://paymentsandrisk.com/docs/reference/decline-codes/) - Understanding decline reasons
-   [Authorization Basics](https://paymentsandrisk.com/docs/payments/reference/authorization-basics/) - Auth fundamentals
-   [Benchmarks](https://paymentsandrisk.com/docs/reference/benchmarks/) - Industry auth rate targets
-   [Payments Experimentation](https://paymentsandrisk.com/docs/reference/experimentation/) - A/B testing changes
-   [Increase Auth Rates](https://paymentsandrisk.com/docs/playbooks/increase-auth-rates/) - Optimization playbook
-   [3D Secure](https://paymentsandrisk.com/docs/fraud/prevention/3ds/) - 3DS troubleshooting
-   [Processor Management](https://paymentsandrisk.com/docs/operations/processor-management/) - Processor relationships
-   [Alerts Configuration](https://paymentsandrisk.com/docs/operations/alerts-configuration/) - Setting up monitoring
-   [Payments Metrics](https://paymentsandrisk.com/docs/payments/metrics/) - Tracking auth rates
-   [Processor Switch Checklist](https://paymentsandrisk.com/docs/playbooks/processor-switch-checklist/) - When migration causes issues
-   [Card Payments](https://paymentsandrisk.com/docs/payments/payment-methods/cards/) - Card type impacts