Card network retry rules for failed payments: Visa and Mastercard

Visa and Mastercard retry rules for declined recurring payments: attempt limits, the 30-day and 24-hour windows, never-retry codes, fees and a compliance checklist.

TL;DR: the card networks limit how often a declined card can be reattempted and forbid reattempts on certain decline responses. Visa's rule caps reattempts at 15 per card within 30 days of the original decline; Mastercard's Transaction Processing Excellence program limits repeated authorization attempts on the same card within a 24-hour window and monitors monthly excess. Retrying a hard decline (lost, stolen, pickup, closed account, do-not-retry responses) is not allowed at all. Breaking the rules brings per-attempt fees and, for repeat offenders, acquirer penalties. Recovery tooling has to be built around these limits, which is why timing matters more than volume.

This page is a practical summary for subscription merchants as of mid-2026. Network rules change; confirm current thresholds and fee amounts with your acquirer or processor.

Why the networks limit retries

Every authorization attempt costs issuers processing capacity, and a declined card that is hammered with retries generates no revenue for anyone. From 2021 both Visa and Mastercard introduced programs to reduce excessive reattempts on declined transactions, especially recurring ones. The programs define attempt limits, name the response codes after which no reattempt is permitted, and charge fees to acquirers (passed on to merchants) for attempts beyond the limits. Processors such as Stripe enforce parts of these rules automatically, which is one reason Stripe Smart Retries cap attempts at 8.

Visa

Rule	What it means for recurring billing
Reattempt limit	No more than 15 reattempts of a declined transaction on the same card within 30 days of the original decline.
Do-not-retry responses	Reattempts are not permitted after responses such as 04 (pickup card), 14 (invalid account), 41 (lost card), 43 (stolen card), 46 (closed account), 57 (transaction not permitted), R0 and R1 (stop payment or revocation of authorization), R3 (revocation of all authorizations). Any reattempt after these is non-compliant.
Fees	Per-attempt fees are assessed on reattempts above the limit or after a do-not-retry response, with escalation for merchants that persistently exceed.
Data quality	Recurring transactions must carry the correct indicators (recurring, merchant-initiated) and stored-credential framework data.

Mastercard

Rule	What it means for recurring billing
Excessive authorization attempts	Under the Transaction Processing Excellence program, repeated authorization attempts on the same card after a decline are limited within a 24-hour window (the published threshold is 10 attempts) and monitored for excess over the month.
Do-not-retry responses	Reattempts are not permitted after hard decline responses including 04, 14, 41, 43, 46, 54 (card no longer valid), 57 and 62 (restricted card), and after the Merchant Advice Codes that tell the merchant not to retry (for example 03, do not try again, and 21, recurring payment cancelled).
Merchant Advice Codes	Mastercard returns a Merchant Advice Code with many declines: 01 (new or updated account information available, use the account updater), 02 (try again later), 03 (do not try again), 21 (recurring payment cancelled by cardholder). Recovery logic should read and respect these.
Fees	Per-attempt fees for excessive or prohibited reattempts, assessed to the acquirer and passed on.

What this means for recovery strategy

The limits make timing, not volume, the lever. With at most 15 attempts a month on Visa and tight daily limits on Mastercard, a fixed schedule that retries every few days uses up attempts on days when the customer's account is unlikely to have funds. A model that predicts the best moment for each card (payday cycles, time of day, issuer behaviour) recovers more with fewer attempts and stays inside the limits with room to spare. FlyCode's engine enforces these rules by design: it never reattempts a card after a do-not-retry response, tracks attempts per card against the network windows, reads Mastercard Merchant Advice Codes, and moves hard declines to backup payment methods or customer outreach instead of retrying. Its models are trained with Visa and Mastercard network data, and FlyCode is a Mastercard network partner and Visa Everything Award winner.

Practical checklist for merchants

• Classify every decline as soft or hard on arrival and stop retrying hard declines immediately.

• Count attempts per card, not per invoice, across all systems that can retry (processor, billing platform, recovery tool). Two retry engines on the same card is the most common way to breach the limits.

• Enable Card Account Updater and Network Tokens so updated credentials arrive instead of repeated declines on outdated ones.

• Flag recurring and merchant-initiated transactions correctly.

• Prefer fewer, better-timed attempts over more attempts.

Related

• Decline Codes Explained

• Subscription payment decline codes guide for Stripe

• Stripe Smart Retries complete guide

• Stripe decline codes reference with network response codes