You’re paying on a site that uses Stripe. You type the card details carefully, press Pay, and get “Your card was declined.” Your bank app shows nothing. You try again and get the same message. What actually happened, and who said no?
Quick answer
1. A Stripe payment can be refused at four layers: the merchant’s Radar rules, the CVC and postal-code checks, 3D Secure, and your issuer.
2. If your bank shows no attempt, the payment was probably stopped by Radar before it reached the bank.
3. You can fix details, funds, 3DS and repeated attempts. You can’t change a merchant’s rule against prepaid cards or cards from your country.
The path of a Stripe payment
When you press Pay, Stripe doesn’t just pass your card to the bank. The payment goes through a sequence, and any step can stop it:
1. Radar risk check. Stripe’s fraud system scores the payment and applies the merchant’s rules.
2. Authentication. If the merchant, the rules or the regulations require it, you get a 3D Secure challenge.
3. Authorization. Stripe sends the request through the card network to your issuer, with the CVC and postal code for the issuer to check.
4. Post-authorization rules. The merchant can still block a payment the issuer approved, for example if the CVC or postal code didn’t match.
The message you see is often the same generic “declined” whichever layer said no. That is deliberate: detailed reasons help people testing stolen cards.
Layer 1: Radar blocks before the bank sees anything
Radar gives every payment a risk score. Stripe’s documentation says that a score of 65 or more counts as elevated risk and 75 or more as high risk, and payments Radar rates at the highest risk level are blocked by default. [VERIFY: current default block behavior on Stripe’s Radar rules page] A blocked payment is marked not_sent_to_network: Stripe never asked your bank.
That explains the most confusing case. If your bank shows no attempt at all, Radar (or a merchant rule) probably stopped it. Calling your bank won’t help, because the bank never saw the payment.
Signals that raise the score include:
- An IP address in a different country from the card’s issuing country.
- A new email address, a new device and a new card all at once.
- Several failed attempts in a short time, especially with different cards.
- A billing address or postal code that doesn’t match what the issuer has.
Merchants can also write their own Radar rules. Stripe’s rules can use the card’s funding type and country, so a merchant can block prepaid cards, or cards from certain countries, or allow them only below an amount. Those are the merchant’s business decisions, and no detail you type will change them.
Layer 2: CVC and postal-code checks
The CVC is the three or four digits on the card. The postal-code check compares the code you type with the one your issuer has on file. Stripe passes both to the issuer, and the issuer returns a pass, fail or “unavailable” result.
Many merchants block payments when either check fails, either through Radar’s defaults or their own rules. Stripe’s acceptance docs note that Radar can block payments with a mismatched CVC or postal code.
For buyers, the common traps are:
- No address on file. Some prepaid and virtual cards have no billing address until you save one. The issuer then returns “unavailable”, which some merchants treat as a fail.
- Format differences. UK and Canadian postcodes with or without the space, US ZIP vs ZIP+4, a postal code with a leading zero dropped.
- Wrong address. An old address after a move, or a work address instead of the one the bank has.
Layer 3: 3D Secure
3D Secure (3DS2) asks your issuer to confirm that you’re the cardholder. Often it’s invisible: the issuer approves on device and transaction data. Sometimes it’s a challenge: a code by SMS, a push in your banking app, or a code in a card dashboard.
In the EU and UK, strong customer authentication rules mean many online payments need 3DS. Elsewhere, the merchant or Radar can request it for risky payments.
The failure modes are simple: the challenge times out, the code goes to an old phone number, the bank’s app isn’t set up, or the card doesn’t support 3DS. If the card can’t complete the challenge, the payment fails.
Layer 4: The issuer’s answer
If the payment gets this far, your bank decides. Stripe translates the issuer’s response into its own decline codes:
| Stripe decline code | What it usually means | Can the buyer fix it? |
|---|---|---|
| insufficient_funds | Balance or credit isn’t enough, including tax or currency conversion | Yes: add funds and retry |
| incorrect_cvc / incorrect_zip | CVC or postal code doesn’t match the issuer’s records | Yes: correct the details |
| expired_card | Expiry date is in the past or was typed wrong | Yes: check the date or use the new card |
| authentication_required | Issuer wants 3DS that wasn’t completed | Yes: retry and complete 3DS |
| do_not_honor / generic_decline | Issuer declined without a reason; Stripe says this is the most common issuer decline | Sometimes: ask the issuer |
| card_not_supported | Card can’t be used for this type of purchase | Maybe: ask the issuer whether online or international use is blocked |
| Blocked by Radar | Payment never sent to the issuer | No: only the merchant can change it |
The buyer doesn’t always see the code, but the merchant does. A support message to the merchant with the time and amount often gets you the exact reason.
A buyer’s procedure for a Stripe decline
1. Check your bank app. An attempt there means the issuer declined. No attempt means Radar or a merchant rule stopped it.
2. Check the card itself. Look up its BIN (the first 6–8 digits) to see the network, the prepaid flag and the issuing country, which is what the merchant’s rules see.
3. Fix the details. Re-type the card number, expiry and CVC. Use the billing address and postal code your issuer has on file, in the issuer’s format.
4. Check the amount. Fund the card with the full total, including tax and any currency conversion.
5. Be ready for 3DS. Have your banking app or card dashboard open.
6. Turn off anything that hides your location, such as a VPN or a privacy relay, and pay from your normal connection. A mismatch between your IP and card country raises the risk score.
7. Stop after two failures. More attempts, especially with different cards, look like card testing and raise the score further.
8. Ask the merchant for the decline reason, or ask your issuer if it was an issuer decline.
What you can’t fix
Some refusals are the merchant’s choice: a rule against prepaid cards or a list of countries they don’t sell to. Those apply whatever card you use. If a merchant doesn’t sell to your country, respect that; don’t try to get around it with a different card or location.
Prepaid and virtual cards on Stripe checkouts
Prepaid cards often work on Stripe-powered sites, but they are the cards most often caught by merchant rules, and the ones most likely to have no address on file. Before you use one, check what the merchant will see. VCCBuy runs a free BIN checker that shows a card’s network, type and prepaid flag.
For readers who fund cards from stablecoins, VCCBuy’s own cards are prepaid Visa and Mastercard cards topped up with USDT, USDC and other coins. You can save a billing name and address on each card, and the 3D Secure code is shown in the dashboard for 10 minutes, so no phone number is needed. They are still prepaid, though: VCCBuy is not a bank, and a merchant that blocks prepaid cards will decline them. Bank-issued virtual cards and PayPal are other options where the merchant accepts them.
FAQ
Why does Stripe decline my card when my bank says everything is fine? The payment may have been blocked by Radar or a merchant rule before it was sent to your bank. In that case your bank never saw it. Ask the merchant for the decline reason.
Does a failed postal-code check always cause a decline? No. The issuer reports the result, and the merchant decides what to do with it. Many merchants block mismatches, so it’s worth getting the postal code exactly right.
Will retrying many times eventually work? Usually the opposite. Repeated attempts raise the risk score. Fix the cause, then retry once.
Conclusion
A Stripe decline can come from Radar, the CVC and postal-code checks, 3D Secure or your issuer, and the message rarely tells you which. Check your bank app first, then fix what’s yours to fix: details, address, funds, 3DS and the number of attempts. What’s left is the merchant’s rule, and only the merchant can change it.
About the author: [Author name] is a payments and fintech writer at VCCBuy (https://vccbuy.net/), where they cover virtual cards, card networks and spending stablecoins online. They write about checkout risk systems and decline codes, from the buyer’s side of the payment form.
Disclosure: the author writes for VCCBuy, which is mentioned in this article.
Leave a Reply