PayPal · Decline codes
What does PayPal processor response code 9510 mean?
Checked
PayPal processor response code 9510 (SECURITY_VIOLATION) means the payment was declined for a security violation. PayPal gives no more detail than that label, and banks keep such reasons to themselves. Retrying the same card is unlikely to help; the shopper should use another card or ask their bank, and the merchant should offer another payment method.
- PayPal label
- SECURITY_VIOLATION
- Type
- Hard decline
- Who declined
- The card's bank or network (via PayPal)
- Similar Visa code
- 63 (Security violation): Visa Category 4 at Visa (generic)
- Retry
- No, not on the same card
- Shopper action
- Use another card or ask the bank
- Merchant action
- Don't retry; offer another method
- PlatformDTC renewal
- No retry; one-click update-card link and reminders
What PlatformDTC does
PlatformDTC maps PayPal 9510 to security_violation, a decline no retry can fix. On either retry schedule (the default Fixed schedule or Smart retry), the renewal is never re-attempted on that card: the subscription is held past due (not cancelled) and the customer gets a one-click update-card link, re-sent up to 4 times per cycle. If those reminders run out and the store's auto-cancel setting is on, the subscription ends as involuntary churn.
Why it happens
Something about the payment broke a security rule at the bank or network. Which rule is not shared.
What the shopper can do
Pay with another card or your PayPal balance; your bank can tell you more about this card.
What the store can do
Ask for another payment method.
Look at the order's other risk signals before fulfilling.
For developers
PayPal returns 9510 in processor_response.response_code on the capture (purchase_units[].payments.captures[]) or authorization of a card payment. PayPal's own name for it is SECURITY_VIOLATION.
Visa has a similarly named raw response code, 63 ("Security violation"); in the Visa Core Rules (24 October 2026, Table 7-2) that code is category 4 at Visa (generic). PayPal's code list doesn't map its codes to Visa's, so treat this as context, not a translation.
Declined card payments can also carry payment_advice_code in processor_response, the card network's advice; store it next to the response code.
Frequently asked questions
- Is 9510 the same as suspected fraud?
- PayPal lists them separately: 9500 is SUSPECTED_FRAUD, 9510 SECURITY_VIOLATION. Neither should be retried on the same card by PlatformDTC.
- Can the shopper fix 9510?
- Only their bank can explain or lift it.
Sources
Related
- 9500 — Suspected fraud: the payment was flagged; PayPal says use another card.
- 5180 — Invalid or restricted card: this card can't be used; PayPal says try another.
- PPAB — Account blocked by issuer: the card's bank has blocked the account.
- 9520 — Lost or stolen: the card was reported lost or stolen; PayPal says use another card.
- 9530 — Hold, call center: the merchant must call the number on the back of the card.
- 9540 — Refused card: the card was refused for this payment.
- 00N7 — CVV2 failure, retry with CVV: the security code failed; try again with the right one.
- PCVV — CVV failure: the card security code check failed.