Payments · Online Pharmacy6 min readUpdated November 2, 2026

Reducing Payment Declines for Online Pharmacies

Why online pharmacy payments get declined: issuer refusals, HSA and FSA cards, expired authorizations, Visa's retry limits, and measuring approvals.

Nick Bonnassies, CMO at Tagada · checked against 10 sources

Article summary

TL;DR

A payment fails because the card issuer declines it, the processor's fraud tool blocks it, or the integration sends bad data. Pharmacies add two of their own: HSA and FSA cards your store isn't set up for, and authorizations that expire during prescription review. Fix the data, set up health cards, capture in time, and retry only within Visa's limits.

Stripe names three failure types: issuer declines, blocked payments and invalid API calls.
Under IRS Notice 2007-2, health FSA and HRA debit cards work at a pharmacy only with an inventory approval system (IIAS) or if 90% of the store's prior-year receipts are medical items.
The 90% route is open only to MCC 5912 and 5122, with annual re-attestation (SIGIS).
An online card authorization is valid 7 days at checkout for Visa and Mastercard; capture after that fails.
Visa's October 24, 2026 rules allow up to 20 attempts in 30 days on retryable codes and none on category 1 codes.

Want to go further? Ask

On this page

This guide is part of our hub on online pharmacy payment processing. The general guide, for any business: why payments are declined and how to fix them. Prescription brands can also apply to Tagada Rx, which runs storefront, doctors, pharmacy and payments in one stack.

Three kinds of failure

Type	Who decides	What to do
Issuer decline	The patient's bank	Read the decline code; retry only retryable codes1 2
Blocked payment	Your processor's fraud tool, before the issuer	Review rules; a strict rule refuses good patients1
Invalid call	Your integration	Fix the data sent: CVC, address, amount, expired authorization1

Issuers decide on "spending habits, account balance, and card data (expiration date, address information, and CVC)"3. Your pharmacy code, 5912, tells them what you sell: MCC 5912.

Why pharmacy payments fail

Cause	What you see	Fix
HSA or FSA card at a store not set up for it	Decline on a card that works elsewhere	Accept health cards through the right route (below)
Authorization expired before capture	Payment canceled, no charge	Capture within 7 days, or use an extended authorization where eligible8
Insufficient funds on a refill	Soft decline on renewal	Retry over several days, notice before the charge
Expired or replaced card on file	Hard decline on renewal	Card updater, ask for a new card
Unfamiliar descriptor or foreign issuer	Generic "do not honor"	Brand in the descriptor; see international payments
Fraud rule too strict	Blocked before the issuer	Tune rules, 3DS instead of a block

Fig. 1Where a pharmacy payment can fail, stage by stage

approved declined or closed routing step

AttemptPatient pays at checkout or refill
checked byFraud rulesToo strict: good patients blocked
sent toIssuerHealth card declines if the store isn't set up
approvedAuthorizedHold placed; capture within 7 days
thenCapturedCharged once the prescription is approvedApproved

A blocked payment never reaches the issuer; an expired hold never reaches capture.

Stripe Docs, Declines and Place a hold on a payment method; IRS Notice 2007-2.

HSA and FSA cards

Many patients pay prescriptions with a health card. These cards decline unless your store is set up for them.

The IRS rule
Health FSA and HRA debit cards may not be used at stores with the Drug Stores and Pharmacies code unless the store uses an IIAS or 90% of its prior-year gross receipts are medical items4.
Two routes at Stripe
Use an HSA/FSA-eligible MCC if you provide qualified medical services, or "attest that over 90% of their volume processes HSA/FSA goods"7.
The 90% route
Limited to MCC 5912 and 5122; "the IRS requires annual registration and re-attestation"5.
No guarantee
"Enabling an account to accept HSA/FSA payments doesn't guarantee a card won't be declined"7.

Common health card declines listed by SIGIS6:

The card isn't activated, or has no funds for the new plan year.
The plan only reimburses the prescription amount, and the merchant doesn't send it in the authorization.
The merchant doesn't support partial authorization and the order mixes eligible and other items.
The patient's plan doesn't allow 90% registered merchants.
The patient uses an old card closed after a plan change.

Watch out

A lapsed 90% re-attestation makes every health card decline at once. Put the renewal date in your compliance calendar.

Retry rules

Rule	What it says
Category 1 codes (lost, stolen, closed, invalid)	Never resubmit for the same card (Visa)2
Categories 2, 3 and 4	"Up to 20 attempts in 30 days" (Visa)2
What a retry can't change	MCC, merchant country, acquiring identifier, ecommerce indicator (Visa)2
Stripe's limit	At most 8 retries per charge; more can look like fraud (Stripe)3

Visa attempts allowed in 30 days on category 2, 3 and 4 codes

7 days

To capture an authorization, unless extended where eligible

Stripe's maximum retries per charge

A second processor helps only when the first one is down or times out. It is not a way around your processor's fraud rules. It doesn't turn an issuer's category 1 code into an approval: sending that card elsewhere is still a reattempt2.

Fig. 2When a second processor helps, and when it doesn't

Issuer decline, category 1

RefillCard on file
routes toProcessor ADeclined: card closedDeclined

Stop: never resubmit this card

Processor down

RefillCard on file
routes toProcessor ADown / timed outDeclined
falls throughProcessor BApprovedApproved

Refill paid on the next processor

The cascade answers an outage, never a no from the bank.

Illustrative example.

Tagada follows Visa and Mastercard rules and the laws that apply to payments.

Recovering failed refills in the tool: failed payment recovery for online pharmacies.

Measure your approval rate

Metric	Formula	Watch for
Approval rate	Approved ÷ unique attempts, excluding retries1	Drops after a new offer, state or processor
Capture rate	Captured ÷ approved	Expired authorizations during review
Health card approval	Approved ÷ HSA/FSA attempts	Sudden drop: re-attestation or MCC issue
Block rate	Blocked ÷ attempts	Fraud rules too strict
Approval by issuing country	Same, by country	Foreign issuers on a US pharmacy

Fraud rules and 3DS without losing good patients: fraud prevention and 3D Secure for online pharmacies.

How Tagada helps

Fewer failed prescription payments, from hold to refill

Tagada Rx runs storefront, doctors, pharmacy and payments in one stack, with the timing built in10:

Hold at checkout, capture on approval: decline voids the hold; money never leaves the card if the clinician doesn't prescribe9.
Rebill on ship day: recurring treatments rebill the day the pharmacy ships, not on a calendar date9.
Routing across TagadaPay and processors such as Stripe, NMI and Airwallex, with one logic; cascade to another processor when one is down or times out, never after an issuer decline.
Native 3DS2, device intelligence and a rules engine.

Tagada Rx is open by application to a selected group of brands: see how Tagada Rx works.

Apply to Tagada Rx

Fewer failed prescription payments, from hold to refill

Updated on November 2, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Why are payments declined on my online pharmacy?

The issuer refused, your processor blocked the payment, or your integration sent invalid data. Pharmacies also see health card declines when the store isn't set up for HSA and FSA cards, and failed captures when an authorization expires during review.

Why was a patient's FSA card declined?

Often because the store doesn't meet the IRS route for pharmacies: an IIAS or the 90% rule. Other causes per SIGIS: no funds for the new plan year, the prescription amount not sent, no partial authorization, or a plan that excludes 90% merchants.

Can an online pharmacy accept HSA and FSA cards?

Yes, through a processor that supports them. Stripe offers two routes: an HSA/FSA-eligible MCC, or attesting that over 90% of volume is eligible. The 90% route is limited to MCC 5912 and 5122 and needs yearly re-attestation.

How long can I hold a card before capturing?

Usually 7 days for an online checkout payment on Visa and Mastercard, per Stripe. If the prescription review takes longer, the authorization expires and the payment is canceled. Some payments qualify for extended authorization.

Should I retry a declined payment?

Only if the code allows it: Visa forbids retrying category 1 codes and caps the others at 20 attempts in 30 days. Stripe recommends at most 8 retries per charge. Never retry a block marked "do not try again".

Sources

Checked November 2, 2026

Tagada Rx

Fewer declined prescriptions, at checkout and at refill

Tagada Rx runs the stack behind your brand. Open by selection: every application is reviewed, and we reply to each one.

Apply to Tagada Rx

01Tell us about your brand
02We review every application
03Go live under your brand after review