Decline code · Hard decline
Decline code 43: Stolen Card
The card was reported stolen and the issuer has hard-blocked it with instructions to capture it if physically presented. Every authorization attempt on this number will fail permanently. An attempt at your checkout means someone is trying to spend on credentials their owner reported to the police or bank as stolen.
Should you retry?
Never. Stolen status never lifts from that card number, reattempts breach network rules, and each additional attempt strengthens the appearance that your platform is a tool for spending stolen cards.
Why code 43 happens
- The cardholder reported theft and the issuer moved the account into stolen status.
- Stolen card data purchased on a fraud marketplace is being tested or spent at your checkout.
- A stored credential in your vault belongs to a card its owner has since reported stolen.
- Organized fraud rings are working through a batch of stolen credentials against merchants with weak controls.
What to do about it
- Refuse the transaction with no retry path and do not process any order for this attempt.
- Escalate the session in your fraud tooling: fingerprint the device, flag the email and shipping address, and look for linked accounts.
- Block the PAN hash platform-wide so the same credentials cannot be recycled through another storefront or account.
- Audit recent approved orders sharing the same device, IP, or address, since one stolen-card hit often accompanies others that got through.
Frequently asked questions
- What should I do when a transaction returns stolen card code 43?
- Cancel the attempt, do not fulfill anything, and review the session for fraud. Block the card from further attempts on your platform and check whether the same device or address is linked to other recent orders.
- Does a code 43 decline affect my merchant account?
- A single occurrence, no. A pattern of stolen-card attempts flowing through your checkout raises your risk profile with your acquirer, so sustained 43 volume is a prompt to strengthen fraud controls rather than a statistic to ignore.
Related decline codes