What does security violation mean on a card decline?

A verification element failed at the issuer, most often the CVV security code, sometimes chip or stripe cryptographic data. The issuer doubts the credentials are legitimately held, so it refused the transaction.

Should code 63 declines be retried automatically?

No. Retrying failed security data reproduces the failure and looks like guessing. Let the customer re-enter their details once by hand, and block further attempts if the code repeats.

Decline code · Hard decline

Decline code 63: Security Violation

A security check failed at the issuer: the CVV or card verification data did not match, a cryptographic validation failed, or the transaction breached the issuer's security policy. The issuer is telling you the credentials as presented cannot be trusted, which is a sharper statement than a generic decline.

Should you retry?

One customer-driven re-entry with corrected data is acceptable; automated retries are not, because the failed check will keep failing on the same inputs and clustered security failures escalate the card into deeper fraud status at the issuer. Fix the data or stop.

Why code 63 happens

The CVV2 or security code submitted does not match the issuer's records, on some processors surfaced as 63 rather than a dedicated CVV code.
Chip cryptogram or magnetic stripe CVV validation failed, indicating cloned or tampered card data in card-present contexts.
The transaction violated an issuer security rule, such as arriving through a channel flagged for compromise.
A fraudster holds the card number but not the security code and is guessing values.

What to do about it

Allow one careful re-entry of the card details in checkout, since honest CVV typos happen, but stop after that.
Treat repeated 63 responses on one card as guessing behavior and block further attempts from the session.
Never store CVV values to sidestep re-entry; PCI DSS forbids retaining them post-authorization in any form.
Correlate 63 spikes with other fraud codes across your traffic, because a rise usually accompanies a testing campaign against your checkout.

Frequently asked questions

What does security violation mean on a card decline?: A verification element failed at the issuer, most often the CVV security code, sometimes chip or stripe cryptographic data. The issuer doubts the credentials are legitimately held, so it refused the transaction.
Should code 63 declines be retried automatically?: No. Retrying failed security data reproduces the failure and looks like guessing. Let the customer re-enter their details once by hand, and block further attempts if the code repeats.

Related decline codes