Card declines & risk rules

Whop Cards apply a set of system rules, card limits, and real-time risk checks to every authorization. This page explains the most common reasons a card transaction is declined, the authorization codes you may encounter, and the automatic risk rules enforced during authorization.

Common transaction decline reasons

Declines can occur for several reasons, including system rules, card limits, and real-time risk checks. When a transaction is declined, a reason describing the cause is recorded with the transaction. This list is not exhaustive. Some declines originate at the card network or processor rather than from a Whop rule, and these take precedence. In those cases the reason may be a generic description such as restricted card, or may not be available at all.

What you can do about a decline

Many declines are expected outcomes you can act on. The table below maps common reasons to their cause and your next step:

Decline reason	What it means	What you can do
`card spending limit exceeded`	The card’s configured spending limit was reached	Review or adjust the card’s spending controls
`account credit limit exceeded`	Insufficient available balance for the transaction	Add funds to your balance before retrying
`card locked` / `card canceled` / `card not activated`	The card is not in an active state	Manage the card’s status (activate or unlock as appropriate)
`invalid pin attempt limit exceeded`	Too many incorrect PIN attempts; the card is automatically locked	Unlock the card to restore access, or contact Whop support
`transaction declined by risk rules`	The authorization was declined by the fraud risk scoring engine	Contact Whop support if you believe a transaction was declined in error
`restricted country`	The transaction originated in a restricted or sanctioned jurisdiction	These declines follow compliance policy and cannot be overridden

A few additional defaults worth noting:

ATM withdrawals are disabled by default.
Quasi-cash and certain money-transfer categories are restricted by default.
3D Secure (3DS): a failed 3DS verification can result in a decline.
Address Verification (AVS): AVS is supported and configurable per card; mismatches can contribute to a decline.

Authorization codes and their meanings

Whop Cards use specific authorization codes to classify the context and status of each transaction. Here are some commonly encountered codes:

Code	Meaning
00	Normal presentment
01	Customer not present
02	Unattended terminal - card can be retained
03	Merchant suspicious
05	Customer present, card not present
06	Pre-authorized request
07	Telephone device required
08	Mail/telephone order
09	POS security alert
10	Customer identity verified
11	Suspicious Activity
12	Security reasons
13	Representation of item
14	Public utility terminal
15	Customer’s terminal
16	Administrative terminal
17	Returned item
18	No check in envelope - return
19	Deposit out of balance - return
20	Payment out of balance - return
21	Manual reversal
22	Terminal error - counted
23	Terminal error - not counted
24	Deposit out of balance - apply
25	Payment out of balance - apply
26	Withdrawal error - reversed
27	Unattended terminal - card cannot be retained
51	Request for account number verification
59	E-commerce request through public network
71	Card present, magnetic stripe unreadable (U.S. only)

Risk rules enforced during authorization

Whop Cards enforce automatic risk detection rules to prevent high-risk or suspicious transactions. Each rule includes a time window and trigger threshold:

Rule name	Description	Time window	Trigger threshold
Blocked Country	Decline all transactions at blocked countries	Immediate	N/A
High Risk MCC	Decline transactions with high-risk MCCs	Immediate	N/A
High Risk E-commerce	Decline transactions with flagged online merchants	Immediate	N/A
E-commerce Rapid Transaction	E-commerce transaction burst prevented, more than 2 transactions were attempted within a 5-minute period	5 Minutes	2 Transactions
Card-present Rapid Transaction	Card-present transaction burst prevented, more than 2 transactions were attempted within a 5-minute period	5 Minutes	2 Transactions
Card-not-present Daily Velocity	Card-not-present transaction daily limit reached, more than 11 card-not-present transactions attempted within a 24-hour period	24 Hours	11 Transactions
Card-Merchant Daily Velocity	Decline transactions between the same card and merchant when more than 200 transactions occur within a 24-hour period. Surfaces as `transaction declined by risk rules`	24 Hours	200 Transactions
Card-Merchant Authentication 15min Burst Velocity	Decline Google temporary-hold (authentication) charges when the same card and merchant exceed 20 transactions within a 14-minute window	14 Minutes	20 Transactions
AFD Auth Hold	Fuel (MCC 5542) authorizations below $175 are placed on an over-authorization hold rather than declined	Immediate	$175 USD
Gaming Limit	Decline single video game/digital goods (MCC 5816/7994) transaction above $2,000	Immediate	$2,000 USD
Gaming Velocity	Decline if more than 25 gaming transactions within a 2-day period	2 Days	25 Transactions
Ad Services Limit	Decline single advertising services (MCC 7311) transaction above $10k	Immediate	$10,000 USD
Ad Services Velocity	Decline if more than 40 advertising services (MCC 7311) transactions within a 24-hour period	24 Hours	40 Transactions
Adult Content Limit	Decline single adult content (MCC 5967) transaction above $200	Immediate	$200 USD
Adult Content Velocity	Decline if more than 10 adult content (MCC 5967) transactions within a 24-hour period	24 Hours	10 Transactions
CVV Security	Block transaction after 4 incorrect CVV attempts within a 24-hour period	24 Hours	4 Transactions
ATM Withdrawal Limit	Block ATM Withdrawal (MCC 6011) transaction exceeding $250	Immediate	$250 USD
ATM Withdrawal Velocity	Block ATM Withdrawal (MCC 6011) transaction velocity limit reached, more than 3 transactions were attempted within a 24-hour period	24 Hours	3 Transactions
High Velocity – EA Sports FC	Decline when more than 5 transactions with the same card at Google EA Sports FC occur within a 24-hour period	24 Hours	5 Transactions
High Velocity – Discord	Decline when more than 10 transactions with the same card at Discord merchants occur within a 7-day period	7 Days	10 Transactions
High Velocity – Free Fire MAX	Decline when more than 10 transactions with the same card at Google Free Fire MAX occur within a 24-hour period	24 Hours	10 Transactions

Default thresholds are shown above and may change over time as risk rules are updated. Alongside these rules, transactions are also scored by a fraud risk engine; high-risk authorizations are declined with transaction_declined_by_risk_rules.

Blocked categories and merchants

Whop Cards block certain merchant category codes (MCCs) and specific merchants by default. See Blocked categories & merchants for the full lists.

Do more with your money

Products

Growth and marketing

Affiliates

Manage business & team

Set up payment processing

Manage payments

Manage payouts

Card declines & risk rules

Common transaction decline reasons

What you can do about a decline

Authorization codes and their meanings

Risk rules enforced during authorization

Blocked categories and merchants

Next steps

Blocked categories & merchants

Whop Cards

​Common transaction decline reasons

​What you can do about a decline

​Authorization codes and their meanings

​Risk rules enforced during authorization

​Blocked categories and merchants

​Next steps

Blocked categories & merchants

Whop Cards

Common transaction decline reasons

What you can do about a decline

Authorization codes and their meanings

Risk rules enforced during authorization

Blocked categories and merchants

Next steps