Authorize.Net · Decline codes
What does Authorize.Net 78 “The card code is invalid” mean?
Checked
Authorize.Net response reason code 78, "The card code is invalid", means the value submitted in the card code field failed format validation, for example too few or too many digits or non-numeric characters. No bank compared it yet; the format itself was wrong. The shopper should re-type the security code, and stores should check that their form accepts four digits for American Express.
- Type
- Error (card data format)
- Who declined
- Authorize.Net's validation
- Retry
- Only with a correctly formatted security code.
- Shopper action
- Re-enter the 3- or 4-digit code.
- Merchant action
- Make sure the field allows 4 digits for American Express.
What PlatformDTC does
Code 78 is not on PlatformDTC's reroute list, and PlatformDTC never sends an unclassified code to a backup processor; the shopper corrects the security code on the same checkout. On a subscription renewal the code is not retried: the subscription is held past due and the customer gets an email with a link to add a new card.
Why it happens
The cardCode field failed Authorize.Net's format check: 3 digits for most cards, 4 for American Express.
What the shopper can do
Type the security code again: 3 digits on the back, or 4 on the front for American Express.
What the store can do
Check field length limits and that the form does not send spaces or hint text.
For developers
errors[0].errorCode "78" (cardCode failed format validation). A correctly formatted but wrong code returns 44 or 65 instead.
Frequently asked questions
- Is Authorize.Net code 78 a CVV mismatch?
- No. It is a format error; a mismatch with the bank's records is code 44 or 65.
- Why does code 78 hit American Express cards?
- Amex uses a 4-digit code; a form limited to 3 digits sends an invalid value.
Sources
- Authorize.Net Response Code Tool (response reason codes) — Authorize.Net
- Authorize.Net response codes (JSON list behind the Response Code Tool) — Authorize.Net
Related
- 44 — The processor declined because the card's security code (CVV) did not match the bank's records.
- 65 — Your card code (CVV) filter rejected the payment based on the security code result.
- 11 — An identical transaction was sent within the duplicate window (two minutes by default).
- 318 — The processor rejected the request as a duplicate of an earlier transaction.
- 17 — Your Authorize.Net gateway is not set up to accept this card brand.
- 28 — Your processor platform is not set up to accept this card brand.
- 56 — The account only processes eChecks, so card payments are refused.
- 39 — The currency sent is not the one your Authorize.Net account is set up for.