Payments
Authorization rate
Authorization rate is the share of attempted card charges that issuers approve, and it is a direct revenue lever for any business billing on stored credentials.
It is influenced by data quality on the request, by whether the credential is a network token, by how the transaction is flagged (customer-initiated versus merchant-initiated), and by the merchant's own decline history.
That last input is why blind retrying is costly beyond the wasted attempts. A pattern of declines against a merchant profile can depress approval on charges that would otherwise have succeeded — the damage is not confined to the transactions that failed.
The denominator problem: what counts as an attempt
The formula is approvals divided by attempts. The argument is always about the second term, and it is not a pedantic argument — the same month on the same book produces materially different numbers depending on which requests you count.
The candidates are all defensible. Every request your application sent. Only requests that reached an issuer, excluding gateway validation failures and network timeouts. Excluding transactions your own risk rules blocked before submission. Counting a retried order once or counting every attempt. Including or excluding zero-amount account verifications, which approve at a very high rate and quietly flatter any rate they are folded into.
Take an example month: 10,000 renewal attempts, of which 9,200 approve first time. Of the 800 failures, 500 are soft declines that are retried three times each, producing 1,500 further attempts, and 300 of those credentials are eventually collected. First-attempt authorisation rate is 9,200 divided by 10,000, or 92.0 per cent. All-attempts rate is 9,500 divided by 11,500, or 82.6 per cent. Eventual collection rate is 9,500 divided by the 10,000 credentials due, or 95.0 per cent.
Three honest numbers, more than twelve points apart, from one month of one book. This is why an authorisation rate quoted without its denominator is not a measurement, and why comparing your rate against a processor's marketing figure or a competitor's conference slide tells you nothing at all.
A blended rate hides which problem you have
A single number can fall for reasons that share nothing operationally, and the number itself will not tell you which one you are looking at.
If hard declines rose, you have a credential-freshness problem: cards aging out, reissues you are not capturing, a book that has not been through an updater. If soft declines rose, you have a customer-funding or timing problem, and the fix is retry scheduling rather than data. If issuer risk declines rose, you have a data-quality or fraud-signal problem, and the fix is what you send with the request. If the drop is concentrated in one country or one card type, you have an acquiring problem and no amount of retry tuning will touch it.
The rate is therefore only useful when it is cut. The dimensions that repay the effort are the decline family, the issuer BIN, the card funding type — credit, debit and prepaid behave differently — the customer-initiated versus merchant-initiated flag, whether the credential was tokenised, the cardholder's country against the acquirer's, and the attempt number within a retry sequence.
Retry policy contaminates the metric it is judged on
Retries enter the denominator, and most retries fail. A team that increases retry aggression will watch its blended authorisation rate fall while collecting more money, and a team that reduces retries will watch the same rate rise while collecting less. Both movements look like performance and neither is.
There is also a real effect underneath the artefact, pointing the same way. A merchant profile submitting a high proportion of declined requests is read by issuer risk models as poor hygiene or card testing, and those models respond by approving less. So reducing pointless retries genuinely does raise the rate, and it also raises it spuriously, and the blended number cannot distinguish the two.
The resolution is to report two figures side by side and never one alone. First-attempt authorisation rate measures the quality of the request: the data, the tokenisation, the flags, the acquiring. Eventual collection rate measures the quality of the recovery: the retry schedule, the updater, the outreach. A change that moves one without the other is telling you exactly where it acted.
What actually moves the rate
The levers below are ordered roughly by how much they typically move a card-not-present subscription book, but the ordering is a starting point rather than a prediction. Which one matters most is a property of your specific mix of markets, card types and credential ages, and the segmentation described above is how you find out before spending anything.
What they have in common is that none of them is a setting. Each changes either the content of the authorisation request, the freshness of the credential behind it, or the number of requests that should never have been sent — which is another way of saying that authorisation rate is an output of how the payment system is built rather than a dial inside it.
| Lever | Mechanism | Shows up as |
|---|---|---|
| Network tokens | Credential never goes stale, and the cryptogram evidences authenticity | Fewer expiry and reissue failures, fewer issuer risk declines |
| Account updater | Refreshes stored cards before the charge is attempted | Fewer hard declines on the renewal cohort |
| Correct CIT/MIT flagging with the initial network transaction ID | The issuer sees an authorised continuation, not an unattached charge | A step change on renewals, often after a platform migration |
| Complete billing data — name, full address, postcode | Gives the issuer's model more to verify against | Fewer generic and risk declines on first charges |
| Local acquiring in the cardholder's market | A domestic transaction is scored differently from a cross-border one | A country-shaped gap in the segmented rate closing |
| Honouring merchant advice codes | The issuer states whether and when to retry | Wasted attempts leaving the denominator |
| Replenishment-aware retry timing | Attempts land when money is plausibly in the account | Higher eventual collection at the same attempt count |
| Stopping retries on hard declines | Removes attempts with zero expected recovery | Both reported rates improving, one of them genuinely |
| 3-D Secure on the initial customer-initiated charge | Authentication shifts liability and satisfies mandated markets | Fewer authentication-required declines in regulated regions |
Frequently asked questions
- What is an authorization rate?
- Authorization rate is the proportion of attempted card charges that issuing banks approve, calculated as approvals divided by attempts. It is a direct revenue measure for any business billing stored credentials, because every point of decline is money that was owed and not collected. Its meaning depends entirely on how attempts are defined.
- How do you calculate authorization rate?
- Divide approved authorizations by attempted authorizations over a period. The decision that matters is what counts as an attempt: whether retries of the same order are counted individually, whether gateway rejections that never reached an issuer are included, and whether zero-amount verifications are folded in. Each choice produces a different, defensible number from identical data.
- What is a good authorization rate?
- There is no portable benchmark, because the number depends on the denominator definition and on the merchant's mix — card-present versus card-not-present, one-off versus recurring, domestic versus cross-border, credit versus prepaid. A subscription book billing years-old credentials across many markets is not comparable to a domestic one-off checkout. Compare your own rate over time, segmented.
- Why did my authorization rate drop?
- Segment before diagnosing. A rise in hard declines points to stale stored credentials. A rise in soft declines points to customer funding or retry timing. A rise in issuer risk declines points to the data sent with the request. A drop concentrated in one country or card type points to acquiring. A rise in retry volume can lower the blended rate while collections are unchanged.
- Do retries lower your authorization rate?
- Both mechanically and genuinely. Retries add attempts to the denominator and most of them fail, so the blended rate falls even when collections rise. Separately, a high proportion of declined requests leads issuer risk models to treat the merchant as poor hygiene or card testing and approve less. Reporting first-attempt rate and eventual collection rate together separates the two effects.
- Do network tokens increase authorization rates?
- They act through three mechanisms: failures from expired and reissued cards stop happening, the per-transaction cryptogram gives the issuer evidence the request is legitimate, and the richer network data supports a better-informed decision. How much that is worth depends on the book. An aged subscription file gains far more than a merchant taking fresh card entry for single purchases.