Optimizing your payment success rate, level 2. 6 chapters and a final quiz.

Chapter 1. Segmenting to diagnose: BIN, issuer, country.

An overall payment success rate of, say, 90% tells you almost nothing, because it is just an average. It mixes French cards approved at 96% with Brazilian cards at 60%, immediate debit cards with prepaid cards, and tokenized transactions with raw PANs. Level 2 optimization always starts with the same discipline: it breaks the rate down into homogeneous segments and treats each segment as a separate problem.

The segmentation dimensions that matter

Since April 2022, the ISO/IEC 7812 standard has extended BINs from 6 to 8 digits, making them far more granular. An 8-digit BIN often identifies a specific issuer portfolio (a card range, a co-brand, or a prepaid program). Your reporting tables need to be migrated to 8 digits. Otherwise, you are lumping together very different populations.

Reading decline codes like an issuer

Chapter 2. Issuer-friendly data: getting the authorization request right.

The issuer's risk engine scores every authorization within tens of milliseconds, and it only “sees” what you send it. A sparse, inconsistent, or badly coded authorization message automatically pushes up the risk score and the likelihood of a 05 (do not honor) decline. Being issuer-friendly means giving the issuer every reason to say yes.

{
  "amount": 7490,
  "currency": "EUR",
  "paymentMethod": {
    "type": "networkToken",
    "token": "4802 63xx xxxx 7821",
    "cryptogram": "AgAAAAAA...",
    "storedCredential": { "usage": "subsequent", "reason": "recurring" }
  },
  "merchant": {
    "descriptor": "PAYPEDIA*ABO-PRO",
    "mcc": "5968",
    "city": "Paris",
    "countryCode": "FR"
  },
  "customer": {
    "email": "client@exemple.fr",
    "accountAgeDays": 412,
    "deliveryMatchBilling": true
  }
}

• Audit a sample of real bank statements to check how the descriptor appears at the main issuers.
• Compare your authorization message, field by field, against the Visa and Mastercard data quality guides.
• Measure the effect of each enrichment with an A/B test (chapter 6), never by gut feeling.

Chapter 3. Network tokens: the credential with a life of its own.

A network token replaces the PAN with a token issued by the network (Visa, Mastercard) through its Token Service Provider (TSP), bound to a merchant × card pair. A PSP token is just an alias in a provider's vault, whereas a network token is recognized end to end. The issuer knows it is authorizing a restricted-use credential, accompanied by a dynamic cryptogram for each transaction.

Chapter 4. Fine-grained SCA exemptions and 3DS steering.

PSD2 requires strong customer authentication (SCA), but its regulatory technical standards (RTS) provide exemptions and place certain flows outside its scope. Fine-grained steering sends each transaction down the best path: an exemption without 3DS, frictionless 3DS, or a full challenge. The trade-off is between conversion, fraud, and liability shift.

{
  "amount": 8200,
  "currency": "EUR",
  "authenticationPreference": {
    "requestedExemption": "transactionRiskAnalysis",
    "fallbackOnSoftDecline": "3ds-challenge",
    "riskScore": 12
  }
}

• Score every transaction in-house (expected fraud, customer value, sensitivity to friction).
• Choose the path: a direct exemption if the score is very low and the amount is within the TRA thresholds; otherwise 3DS, aiming for frictionless with rich data.
• Handle the soft decline: resubmit automatically with 3DS, with no action required from the customer, or you lose the sale.
• Monitor the acquirer fraud rate: if your acquirer crosses a TRA threshold, your entire exemption program drops down a tier.

Chapter 5. Smart retries and multi-acquirer routing.

When a payment is declined, you still have two levers. You can retry the transaction (later, or differently), or reroute it to another acquirer. Both are powerful, and both are governed by rules. Since 2021, the networks have penalized abusive retries, and routing is only worth something when it is driven by data.

Retries: discipline by category

{
  "retryPolicy": {
    "51-insufficient-funds": {
      "maxAttempts": 4,
      "schedule": ["+2d", "payday-next", "+5d", "+7d"],
      "stopIf": ["category1", "chargeback", "customerCancel"]
    },
    "05-do-not-honor": {
      "maxAttempts": 2,
      "mutations": ["useNetworkToken", "force3ds"],
      "schedule": ["+1d", "+4d"]
    },
    "category1": { "maxAttempts": 0, "fallback": "requestNewPaymentMethod" }
  }
}

Multi-acquirer routing: the right path for every transaction

Mature routing rules combine several criteria. Domestic acquiring comes first, because a French issuer responds better to an acquirer that processes locally. Next come the choice of scheme on co-badged cards (CB vs. Visa/Mastercard, a right guaranteed by the IFR) and the token-or-PAN preference by BIN. Last come acquiring costs and each acquirer's real-time health. Moving to well-managed multi-acquiring typically lifts the payment success rate on cross-border flows by +1 to +3 points.

Typical players in a multi-acquirer setupAdyenStripeWorldlineNUNuvei

Chapter 6. Measuring uplift: methodology and case studies.

Most “uplifts” claimed in card payments are artifacts of seasonality, a shift in country mix, or a marketing campaign running at the same time. An improvement can only be credited to an optimization if it holds up in a controlled comparison. That check is the least glamorous part of the job, and the most profitable.

• A/B traffic split: the same population is randomly split between the old configuration (control) and the new one (treatment). This is the gold standard.
• Permanent holdout: keep 5–10% of traffic on the old configuration for weeks to measure the lasting effect, not just the novelty effect.
• Compare like-for-like segments: any difference in mix (country, BIN, amount) between the two arms invalidates the result. Check the balance before drawing conclusions.
• Measure net revenue: authorization rate + fraud + fees (retries, routing, tokens) + chargebacks. An authorization uplift that drives up fraud is a loss.

SELECT
  experiment_arm,
  card_country,
  bin_8,
  COUNT(*)                                   AS attempts,
  AVG(CASE WHEN approved THEN 1 ELSE 0 END)  AS auth_rate,
  SUM(fraud_loss_eur)                        AS fraud_eur,
  SUM(net_revenue_eur)                       AS net_revenue_eur
FROM authorizations
WHERE created_at >= DATE '2026-05-01'
GROUP BY 1, 2, 3
ORDER BY attempts DESC;

Three case studies with real numbers (realistic orders of magnitude)