PayPal · Decline codes
What does PayPal processor response code 9520 mean?
Checked
PayPal processor response code 9520 (LOST_OR_STOLEN) means the card has been reported lost or stolen, so the bank declines it. PayPal's instruction is: "Try using another card. Do not retry the same card." Merchants should never retry it, should show only a general decline message at checkout, and should review the order if the shopper keeps trying other cards.
- PayPal label
- LOST_OR_STOLEN
- Type
- Hard decline
- Who declined
- The card's bank (via PayPal)
- Similar Visa code
- 41 / 43 (Lost card / Stolen card, pick up): Visa Category 1: never resubmit for the same card
- Retry
- No, not on the same card
- Shopper action
- Use a different card
- Merchant action
- Never retry; show a neutral message; review the order
- PlatformDTC renewal
- No retry; one-click update-card link and reminders
What PlatformDTC does
PlatformDTC treats 9520 as lost_card, a hard decline. On either retry schedule (the default Fixed schedule or Smart retry), nothing is retried on the same card; the merchant dashboard says the customer needs to pay with a different card, and the customer receives a signed update-card link (no login) plus up to 4 reminders per billing cycle.
Why it happens
The cardholder or bank reported the card lost or stolen and blocked it.
What the shopper can do
Use another card or your PayPal balance. If this is your card, contact your bank.
What the store can do
Never retry. A plain "your card was declined" is the right message; don't disclose the reason.
Several declined cards in one session followed by a success deserves a manual check.
For developers
PayPal returns 9520 in processor_response.response_code on the capture (purchase_units[].payments.captures[]) or authorization of a card payment. PayPal's own name for it is LOST_OR_STOLEN.
Visa has a similarly named raw response code, 41 / 43 ("Lost card / Stolen card, pick up"); in the Visa Core Rules (24 October 2026, Table 7-2) that code is category 1: never resubmit for the same card. PayPal's code list doesn't map its codes to Visa's, so treat this as context, not a translation.
Keep the raw code with the order. PayPal's label is the only official meaning, and the exact code tells support which branch of PayPal's table fired.
Frequently asked questions
- Should the checkout say the card was reported lost or stolen?
- No. Show a neutral decline. The person paying may not be the cardholder.
- Can a subscriber's card show 9520 if they reported it lost?
- Yes. If they lost the card and got a new one, they simply need to add the new card.
Sources
Related
- 9500 — Suspected fraud: the payment was flagged; PayPal says use another card.
- 5150 — Pick up card, special conditions: the bank wants this card out of use.
- 5140 — Card closed: the card's account has been closed by the bank or cardholder.
- 9530 — Hold, call center: the merchant must call the number on the back of the card.
- 9540 — Refused card: the card was refused for this payment.
- 00N7 — CVV2 failure, retry with CVV: the security code failed; try again with the right one.
- PCVV — CVV failure: the card security code check failed.
- PP06 — Account closed: a previously open account is now closed.