What should happen when an issuer returns a soft decline asking for SCA?

The payment should be retried with a 3DS challenge rather than left to fail. A soft decline means the issuer wants strong authentication before it approves. On NORBr, operators configure that retry in their retry policies, per merchant, so the cardholder is asked to authenticate and the payment has a second chance under the operator's own brand.

Reading the soft decline

A soft decline is not a refusal. The issuer answers that it would approve the payment if the cardholder were authenticated. It usually comes when a merchant or operator requested an exemption from strong customer authentication and the issuer did not accept it. Leaving the payment there turns a willing customer into a lost sale.

The retry

• Detect the specific response code that signals "authentication required".
• Send the cardholder through a 3-D Secure challenge.
• Submit the authorization again with the authentication result.

Where this runs

On a platform, this retry is part of the retry policies configured per merchant, next to fallback between providers and retries on technical errors. It happens in the hosted checkout, under the operator's brand, without the merchant writing code. Reporting then shows how many soft declines were recovered and which issuers send them most often, which feeds back into the exemption strategy: if an issuer rejects most exemption requests, asking for authentication upfront saves a round trip.