Reviewed November 8, 2026

Your Card Was Declined: What the Gateway Code Actually Means

The customer sees Your card was declined. Your gateway log says do_not_honor. Neither message explains anything, and the customer emails you to ask what went wrong, as if you know.

You do know, or you can. The decline code in the gateway log names the reason in the bank's language, and the code decides what happens next: the customer calls their bank, tries another card, or you fix a setting on your side. Reading the code takes thirty seconds, and it turns a mystery into a next step.

The codes that matter, translated

Do_not_honor is the most common and the least informative. It means the bank said no and did not say why, and the customer needs to call the bank. Insufficient_funds means what it says, and the customer should try a different card or a smaller order. Expired_card means the card is past its date, and the fix is a new card. Incorrect_cvc means the security code was wrong, and the customer should check the three digits on the back.

The codes that point at your store are different. Processing_error means the gateway had a problem, and retrying usually works. Authentication_required means the bank wants 3D Secure verification, and the customer needs to complete the challenge. Do_not_try_again means the bank will keep declining this card, and the customer needs a different one. The code is the diagnosis, and the diagnosis decides whether the fix is on the customer's side or yours.

Test mode declines, and the trap they set

Test mode is the most common reason a store declines every real card. In test mode the gateway uses test card numbers and simulates declines, and a store left in test mode after testing will decline real customers with test-mode errors. The fix is a setting, not a card: switch the gateway to live mode and run a real order.

The tell is the pattern. If every card declines, it is a mode or settings problem. If one card declines, it is that card. If a burst of declines comes from one IP address on small amounts, that is card testing, where stolen cards are tried in bulk, and the fix is to block the source, not to keep letting the attempts through.

What to tell the customer

Give the category, not the code. Your bank declined the card is honest and useful. Please contact your bank or try a different card is the next step. The raw code, do_not_honor, means nothing to a shopper, and some reasons should not be spelled out: a decline for suspected fraud is not a conversation to have with the customer.

Log the code and the time. If the same code repeats across many customers in a short window, the problem is on your side, and the log is the evidence your payment provider will ask for. A single decline is a customer problem. Ten identical declines in an hour is a store problem.

Frequently asked questions

What does do_not_honor mean?

It means the cardholder's bank declined the transaction without giving a reason. The customer should contact their bank, or try a different card. There is nothing wrong with your checkout, and retrying the same card usually fails the same way.

What is the difference between test mode and live mode declines?

In test mode, the gateway simulates declines with test card numbers, and no money moves. In live mode, a decline is a real bank decision on a real card. A store stuck in test mode will decline real cards with test-mode errors, which is why test orders that never complete are usually a mode problem, not a card problem.

Should I tell the customer why their card was declined?

Give them the category, not the code. Say the bank declined the card and suggest they contact their bank or try another card. The raw gateway code means nothing to a shopper, and some decline reasons, like suspected fraud, should not be spelled out to the customer.

Can too many declines get my store flagged?

A high decline rate can trigger risk reviews from your payment provider, because it looks like card testing, where stolen cards are tried in bulk. If you see a burst of declines from one IP address or on small amounts, that is card testing, and you should block it rather than keep letting the attempts through.