Can code 63 be retried?

Visa allows it as a Category 4 code, but PlatformDTC stops because a security refusal rarely clears without the cardholder.

Does code 63 mean the card is stolen?

Not necessarily. Stolen cards return 43. 63 is a broader security refusal.

Card issuer response codes (ISO 8583) · Decline codes

What does card decline code 63 mean?

Checked October 31, 2026

Code 63 is an ISO 8583 issuer response code meaning "security violation" on Visa and Mastercard; Visa's table adds "source isn't correct issuer". The bank refused the payment for a security reason it does not explain. Visa does not name 63 in Categories 1 to 3, so it is Category 4, where reattempts up to 20 in 30 days are allowed. The shopper should contact the bank or use another card.

Type: Hard decline (security)
Who declined: The card's issuing bank
Visa category: Category 4 (generic response): up to 20 reattempts in 30 days
Retry: Not recommended
Shopper action: Contact the bank or use another card
Merchant action: Ask for another payment method; review the order
PlatformDTC renewal (fixed or Smart retry): Never retried; customer asked for a new card

What PlatformDTC does

PlatformDTC is stricter than Visa on 63: a raw 63 is never retried. On either retry schedule, fixed or Smart retry, the renewal is held past due and the customer receives a signed link to add a different card. Stripe's matching security_violation code is never-retry in PlatformDTC's checkout routing table too, so it is not offered to a backup processor.

Why it happens

The issuer's security checks failed. The bank does not share which check, and it may relate to the card's security data or the account.

What the store can do

Do not loop retries. Show a neutral decline, suggest another payment method, and look at the order's other risk signals.

For developers

On Stripe the raw issuer code arrives in charge.outcome.network_decline_code (here "63"), next to Stripe's own decline_code. Read it together with the card brand: the same two characters can mean different things on Visa and Mastercard. Stripe reports a matching decline_code, security_violation. Visa lists 6P and Category 3 codes separately for verification-data problems.

Frequently asked questions

Can code 63 be retried?: Visa allows it as a Category 4 code, but PlatformDTC stops because a security refusal rarely clears without the cardholder.
Does code 63 mean the card is stolen?: Not necessarily. Stolen cards return 43. 63 is a broader security refusal.