Why do authentication_required declines happen?

European cards under PSD2/SCA rules require authentication for many recurring charges. The bank's fraud model flagged this particular charge for verification. An off-session subscription charge can't complete authentication without the customer present.

All recovery guides

Failed-payment guideStripe decline reason: authentication_required

How to recover authentication_required failed payments in Stripe

3D Secure / SCA declines need the customer to act, no retry will fix them. The recovery email that gets authentication completed, and why these cases are urgent.

What authentication required means

The customer's bank demands strong authentication (3D Secure / SCA) before approving the charge. The payment is stuck until the customer completes a verification step, usually one tap in a banking app.

Why it happens

European cards under PSD2/SCA rules require authentication for many recurring charges.
The bank's fraud model flagged this particular charge for verification.
An off-session subscription charge can't complete authentication without the customer present.

What Stripe does on its own

Stripe marks the invoice as requiring action and can email a hosted link, but silent retries cannot satisfy an authentication challenge. The customer must click through and approve.

Bank decline codes you may see alongside `authentication_required`

Your customer's bank sends its own numeric code, which Stripe surfaces separately from its decline_code. The same number means different things on different card networks, and Stripe does not publish a strict one-to-one mapping between them, so treat these as codes commonly seen with this failure rather than as equivalents.

Code	Network	What the network calls it
`1A`	Visa	Additional customer authentication required.
`65`	Mastercard	Exceeds withdrawal count limit (or Identity Check soft-decline of EMV 3DS authentication).
`A1`	Cartes Bancaires	Soft decline (electronic commerce only), 3DS with challenge required.
`130`	American Express	Additional customer authentication required.

Quoted from Stripe's network decline codes reference.

The recovery playbook

Send the hosted invoice link with a clear, calm explanation: their bank needs a quick confirmation, it takes under a minute, nothing is wrong with their card.
Treat these as time-critical. Authentication requests expire, and each re-attempt restarts the friction.
Avoid alarming language; 'your payment failed' reads scarier than 'your bank wants a quick confirmation' and produces worse completion rates.
If the same customer hits authentication_required repeatedly, suggest they re-enter the card so Stripe can request an off-session exemption going forward.

Recovery is almost entirely a function of how fast and how clearly you ask. The customer's intent to pay is nearly always intact.

The email to send

This is the exact template MRRdue's recovery assistant suggests for authentication_required cases. Copy it, swap the details, and send it from your own address.

Subject: One quick confirmation for your payment

Hi Alex,

Your bank needs a quick confirmation before your $49.00 payment can go through — it's a routine security step and usually takes under a minute.

Here's a secure link to update your payment details — it only takes a minute:
https://invoice.stripe.com/i/…

Thanks for taking care of it. Reply anytime if you run into any trouble.

Thanks so much,
Your SaaS

More variants (and retention-risk templates) in the free recovery email template gallery.

Stop working declines from a spreadsheet

MRRdue imports your failed payments with read-only access, ranks them by recoverable dollars and decline reason, and drafts this email for every case. You stay the sender.

View live demo Estimate your leak