Approval Rate Recovery in 2026: Routing, Acquirers, and 3DS2
Approval rate problems are often routing problems, not product problems. Here is how transaction routing actually works, what your choice of acquirer does to your auth rate, how 3DS2 frictionless flow can recover transactions you are losing today, and a 90-day roadmap to measure and lift your auth rate.
By Barak Bachar, Global Payments Manager · LinkedIn
A 92% approval rate sounds fine until you do the math. Take a hypothetical merchant with $1M a month in attempted card sales: every percentage point of auth rate is $10,000 of sales per month, $120,000 per year. Going from 92% to 95% is $360,000 a year in sales. That is not optimization. That is a missing line on the P&L.
Many approval rate problems trace back to four causes: wrong routing, wrong acquirer, missing 3DS2 frictionless, or missing network tokenization. Product, checkout UX, and fraud rules matter, but they are second-order. Fix the routing first.
Why approval rate problems are routing problems, not product problems
When a transaction declines, the merchant sees a generic error: "do not honor," "insufficient funds," "contact issuer." Operators assume the customer got declined for a real reason. Often they did not. The issuer declined because the transaction looked unfamiliar: unfamiliar acquirer, unfamiliar BIN, unfamiliar geography, missing trust signals.
Soft declines, the kind that can flip to approvals on a later retry or through a different acquirer, are the recoverable layer. Your decline-code report shows how big that layer is on your account. None of it gets recovered by changing checkout copy or running another A/B test on the buy button.
How interchange routing actually works
When a customer hits Pay, the transaction leaves your gateway, hits a processor, hits an acquirer, hits a card network (Visa, Mastercard), and finally hits the issuing bank. The issuer says yes or no. The answer travels back the same path.
Several hops involve a routing decision. The processor picks an acquirer. On U.S. debit cards, the transaction can often go over more than one network. The network then delivers it to the card's issuer. Most merchants treat this as a black box. It is not. Each hop has a configuration, and the configuration affects your auth rate.
Smart routing means the processor uses real-time data to pick the rail and acquirer most likely to approve a given BIN. Static routing means everything goes through one acquirer regardless. Static routing is what many accounts have, and it can leave approvals on the table. Only your own per-BIN data shows how many.
Acquirer-issuer relationships explained
Issuers (Chase, Citi, Capital One, Wells Fargo, plus thousands of credit unions) decide with their own risk models, and where a transaction comes from is one of the inputs. Approval rates can differ by acquirer on the same traffic.
Interchange is set by the card networks, so it is the same whichever acquirer you use; what differs is the acquirer's markup, its risk rules and how its traffic performs with your customers' issuers. If your processor picked an acquirer only on cost, check what that choice does to your auth rate.
Cross-border makes this worse. Cards issued abroad are a common weak spot for a US merchant routing through a US acquirer, and a local acquirer in the cardholder's country can turn the sale into a domestic one for that issuer. Local acquiring is one of the main levers on cross-border auth.
Rule of thumb: if a meaningful share of your volume, say 15% or more, comes from a single non-domestic country, get a quote for local acquiring in that country. Compare the approval lift you measure in a test with the cost of the integration.
3DS2 frictionless flow
3DS2 is the protocol that lets the issuer see device, browser, and transaction context before approving. Done right, most transactions go through frictionless (no challenge to the customer). Under Visa's rules, a card-absent fraud dispute is invalid when the sale was authenticated through Visa Secure with the CAVV in the authorization (ECI 5), or was an attempted authentication with the CAVV (ECI 6), so the fraud cost moves off you.
Done wrong, 3DS2 forces a challenge on every transaction. Customers see a code prompt, some abandon, and conversion drops. Measure your own abandonment rate at the challenge step. That is not a 3DS2 problem. That is a configuration problem.
The right setup: 3DS2 enabled with frictionless as default, challenge triggered only by risk score above a threshold or by issuer request. Issuers in the European Economic Area work under PSD2 strong customer authentication rules (the UK has its own version), may decline a sale without it, and Visa's response code 1A asks for authentication. On US volume there is no SCA mandate: 3DS is optional, moves card-absent fraud disputes off you under Visa's rules, and on Visa consumer credit card-not-present sales earns a 0.10 percentage point interchange incentive under Visa's October 2026 schedule. Visa ended support for the old 3DS 1.0.2 on October 15, 2022.
Common config mistakes
Missing CVV on card-on-file. Issuers use the CVV match result as a risk input. Capture CVV on the first transaction, store the network token, and never store the CVV after authorization (PCI DSS forbids it).
Wrong MCC code.The merchant category code feeds interchange and the issuer's risk model. A business whose MCC no longer matches what it sells, common after a pivot, can see more declines. Check your MCC against the code list in Visa's Merchant Data Standards Manual and get it right.
Account updater not enabled. Visa Account Updater and Mastercard Automatic Billing Updater catch reissued cards on subscription rebills. Visa requires U.S. issuers to enroll most BINs in Visa Account Updater. Without the updaters, expired and reissued cards show up as declines that look like customer churn. Some processors charge per update, so ask the price and compare it with your expired-card declines. Then enable it.
Static retry on soft declines. Retrying a soft decline through the same acquirer 30 seconds later usually gets the same answer. Retry later, by decline code, or through a different acquirer, and count every attempt toward the network limits: Visa allows up to 20 attempts in 30 days after a retryable decline and none after a Category 1 code, and PayPal's noticelists Mastercard's limits as 10 in 24 hours and 35 in 30 days.
Reading your auth-rate dashboard
Most processor dashboards show an aggregate approval rate. That number lies. Break it down by:
Issuer BIN range. Top 20 issuers by volume, sorted by approval rate. The bottom 5 are your recovery target.
Card type. Credit, debit, prepaid, commercial. Each can carry different issuer rules, so compare them separately.
Geography. Domestic vs cross-border, by country. The cross-border number is almost always the gap.
Decline code.Group by ISO 8583 response code. Code 05 (do not honor), code 51 (insufficient funds), code 14 (invalid card) each have different recovery strategies; under Visa's rules, code 14 is a Category 1 code and must never be retried.
The 90-day improvement roadmap
Days 1 to 14: Pull 30 days of transaction data with full decline-code breakdown. Identify the top 5 issuer BINs by decline volume and the top 3 decline codes. Confirm acquirer BIN. Confirm MCC code. Enable Account Updater if not on.
Days 15 to 30: Turn on network tokenization (Visa, Mastercard). Configure 3DS2 frictionless on EU and UK volume. Implement smart retry on soft declines (delay, retry through alternate acquirer if available, stay inside network retry limits).
Days 31 to 60: If cross-border is more than 15% of volume in a single market, scope local acquiring. If domestic auth on a top issuer is below benchmark, evaluate adding a second acquirer with stronger relationships there.
Days 61 to 90: Measure. Lock in changes that produced lift. Reverse changes that did not. Document the new baseline. Set a quarterly review cadence.
There is no published benchmark for how much this recovers; measure it. On a hypothetical $1M monthly account, each point of approval rate recovered is about $10,000 a month in sales, $120,000 a year. None of it requires new product, new checkout, or new fraud tools.
If reserves or contract terms are blocking the routing changes you need, see the Negotiation Playbook.
Soft declines vs hard declines: the recoverable layer
Not every decline is recoverable. Hard declines (lost card, stolen card, fraud-confirmed, account closed) are final. Soft declines (insufficient funds, do not honor, exceeds withdrawal limit, issuer system error) are recoverable, sometimes immediately on a different routing path, sometimes 24 hours later when the customer's funds clear.
Pull your own split of hard and soft declines from the decline-code report. The soft-decline pool is your recoverable revenue. A smart retry tool, configured against ISO 8583 response codes, can recover part of it without the customer ever seeing a failure message.
The most expensive mistake here is retrying a soft decline through the same acquirer 30 seconds later. The issuer usually returns the same answer, and every attempt counts toward the network limits. Past those limits, or on a Category 1 code, Visa charges fees; PayPal lists Visa's excess reattempt fee at $0.10 per domestic attempt and $0.25 cross-border. Smart retry waits, varies the routing, and respects retry limits the network publishes.
The reserves and contract terms that block routing changes
Approval rate recovery often requires structural changes the current contract was never set up to allow. Adding a second acquirer requires a second MID. Adding a second MID often requires re-underwriting. If the current processor holds a reserve, that reserve does not transfer. If the current contract has an ETF, splitting volume across two processors may trigger it.
These are solvable. Many processors can add a second MID under the same parent account if the volume justification is clean; ask. If they will not, see Capped vs Rolling Reserves for how to negotiate the reserve out, and the Negotiation Playbook for how to remove the ETF.
Treat routing optimization as a 6-month project, not a 6-week one. The technical work is fast. The contract work is what takes time.
Frequently asked questions
What is a normal approval rate for a US ecommerce merchant?
We found no official public benchmark for U.S. card-not-present approval rates. Ask your acquirer for the median in your merchant category and volume tier, and compare yourself with merchants like you. Card-not-present sales generally decline more often than card-present ones, and cross-border cards are a common weak spot, which is why merchants selling heavily into one foreign market often look at local acquiring there.
Will adding a second processor improve my approval rate?
Yes, if the second processor uses a different acquirer with better issuer relationships in your traffic mix. No, if both processors route through the same acquirer. Approval lift comes from acquirer diversity, not from having two logos. Confirm the acquirer BIN before signing.
Does 3DS2 hurt or help approval rates?
It helps when used selectively. Under Visa's rules, a card-absent fraud dispute is invalid when the sale was authenticated through Visa Secure (ECI 5 with the CAVV in the authorization) or was an attempted authentication with the CAVV (ECI 6), so the fraud cost moves off you, and the extra data gives the issuer more to approve on. Forcing a challenge on every transaction hurts because some customers abandon. The right setup is frictionless by default, challenge only on risk signals or when the issuer asks.
What is network tokenization and why does it matter for approval rates?
Network tokenization replaces the card number with a token issued through Visa or Mastercard and bound to your business. Visa reports a 4.8% increase in authorization rates for tokenized card-not-present transactions versus card numbers; your own lift will differ. Tokens also update when a card is reissued, and Visa's October 2026 interchange schedule cuts consumer credit card-not-present interchange by 0.05 percentage points for token transactions. Ask your processor what tokens cost before you count the gain.
How fast can I see auth-rate improvement after a routing change?
Routing changes take effect on the next transaction, so early data shows up within days. Give it at least 30 days before you judge the result, because card mix and traffic patterns shift week to week. Compare approval rate by issuer, card type and decline code before and after, not just the overall number.
Want a 15-minute call with Barak?
If you want a second set of eyes on a contract, statement, or pricing offer, Barak takes a limited number of merchant calls per week.
Get my matched shortlist →