Picture the last time a customer churned because their card got declined. Not because they wanted to leave. Not because your product stopped delivering. Because a string of digits expired, or an issuer flagged the transaction for reasons nobody at your company will ever understand.
Involuntary churn costs SaaS companies around 9% of MRR on average. About 40% of that comes from expired cards alone. The rest is a mix of insufficient funds, issuer declines, fraud blocks, 3DS2 challenges, and the occasional genuinely closed account.
The good news is that most of those declines are preventable, or at least recoverable, if you stack the right defenses. This post walks through the modern decline mitigation toolkit for subscription merchants, and explains why every layer matters, including the last one: dunning.
Think in layers, not silver bullets
There's no single fix for card declines. Anyone selling you one is either overpromising or selling you a subset of the stack. What actually works is a layered defense, where each layer catches failures the previous one missed.
Rough mental model:
- Prevention at authorization (smart routing, 3DS2 exemptions, network tokens)
- Automatic card refresh (account updaters like VAU and MAU)
- Retry optimization (intelligent timing, multiple attempts)
- Customer-facing recovery (dunning sequences, email plus SMS)
- Manual outreach (for high-value accounts)
Each layer has its own mechanics, costs, and failure modes. Most SaaS teams lean too hard on one or two layers and leave the others empty. That's where the money leaks.
Layer 1: Prevention at authorization
This is everything that happens before the payment even has a chance to fail. The goal is maximizing authorization rates on the first try.
Smart routing
Smart routing means dynamically choosing which acquirer or processor handles a given transaction based on the card's issuing bank, geography, and historical performance. Stripe does a lot of this automatically under the hood with Adaptive Acceptance, but larger merchants using payment orchestration layers can route more aggressively.
Real-world lift: smart routing typically improves authorization rates by 5 to 10 percentage points, depending on your geographic mix and card profile. That's not a decline mitigation trick, it's a revenue recovery in disguise.
3DS2 and SCA exemptions
Strong Customer Authentication under PSD2 requires challenges for a lot of European transactions. 3DS2 is the protocol that lets issuers frictionlessly authenticate low-risk payments and only challenge the risky ones.
Where teams mess this up: they either send every transaction through a challenge (tanking conversion) or skip 3DS2 entirely and watch the issuer decline half their EU volume. The right move is using exemptions (low-value, trusted beneficiary, TRA) where eligible and letting 3DS2 handle the rest.
For subscription businesses, MIT (merchant-initiated transaction) flags matter a lot. Once the cardholder has authenticated for the first charge, subsequent recurring charges can be marked as MIT and usually don't require another challenge. Get the MIT flagging wrong and your recurring auth rates drop.
Network tokens
Visa, Mastercard, and Amex all support network tokens: replacement credentials that sit on top of the real card number. The tokens get updated automatically when the underlying card expires or gets reissued.
Network tokens typically lift authorization rates by 2 to 6 percentage points on recurring charges. They also reduce fraud false positives because issuers trust tokenized transactions more. If your processor supports them, turn them on. Stripe supports network tokens automatically for eligible cards on Stripe Billing.
Layer 2: Automatic card refresh
Account updaters (Visa Account Updater, Mastercard Automatic Billing Updater, Amex Cardrefresher) push new card details to merchants when cards expire or get reissued. This catches a significant chunk of the "expired card" bucket before a decline ever happens.
The catch: not every card is enrolled, not every issuer participates consistently, and refresh isn't instant. You'll still see expired-card failures. Account updaters typically catch 50 to 70% of them, not 100%.
Stripe's Card Account Updater runs on Stripe Billing subscriptions and quietly updates cards when issuers push new data. If you're on Stripe Billing, check that it's enabled. If you're not, you're leaving recoveries on the table.
Layer 3: Retry optimization
When a payment fails anyway, retries are your next line of defense. Dumb retries (same time every day for 3 days) recover less than smart retries that account for failure reason, customer timezone, and issuer patterns.
Stripe's Smart Retries use machine learning on their transaction graph to pick retry times more likely to succeed. Typical lift over naive retries is 10 to 15%.
But retries alone top out. Once you've tried three or four times and the card is still declining, retrying again doesn't help. The customer needs to actually do something: update their card, add funds, authenticate with their bank. That's where the next layer kicks in.
Layer 4: Dunning sequences
This is where most of the recovered revenue actually comes from. After the automated layers have done what they can, the remaining declines require customer action. Your job is to make that action easy, fast, and obvious.
A strong dunning sequence has a few characteristics:
- Multi-channel. Email recovers up to 50% of recoverable failures. Adding SMS lifts that by another 15 to 25 percentage points because SMS open rates are 5 to 8 times higher than email.
- Well-timed. The first message goes out shortly after the failure, the next 24 to 48 hours later, and the sequence runs for 10 to 14 days with declining frequency.
- Pre-authenticated links. Every message links to a one-click payment update page. No login, no navigation, no password reset.
- Personalized. Dynamic variables like customer name, amount, and product keep the messages specific and non-generic.
- Respectful. Opt-outs are honored. Customers who cancel stop getting emails immediately.
Dunning is the safety net under all the other layers. Everything that falls through them ends up here. If this layer is weak, your decline mitigation stack has a hole in the bottom.
Layer 5: Manual outreach
For high-value accounts (enterprise customers, annual plans, strategic logos), automated sequences alone aren't enough. A human touch from customer success or account management recovers a meaningful chunk that emails and SMS miss.
This doesn't scale, which is the point. Reserve it for the top 5 to 10% of accounts where the economics justify it.
Layered defense, summarized
If you wanted a quick mental diagram, here's what the flow looks like for a single failed payment:
- Transaction hits Stripe with a network token, smart routing, and appropriate 3DS2 flags. Most succeed here.
- If it fails and the reason is an expired card, account updater may refresh the card automatically. Some succeed here.
- If the refresh doesn't land, Stripe Smart Retries run for up to a week. Some succeed here.
- If the card still declines, dunning sequences kick in via email and SMS with pre-authenticated update links. Most of the remaining recoveries happen here.
- If the customer is high-value, CS reaches out personally. The last few recoveries happen here.
Each layer reduces the load on the next. Skip a layer and you either pay for it in lost revenue or overload the layer beneath it.
Where Rekko fits
Rekko handles layer 4, the dunning safety net, specifically for Stripe users. We don't try to replace smart routing, network tokens, or account updaters. Stripe already does those well natively. What we do is pick up everything that still fails after Stripe has done its part.
That means email plus SMS sequences, pre-authenticated payment links, a real-time ROI dashboard, and GDPR-compliant opt-out handling. Flat monthly pricing, no percentage of recovered revenue. Five minute setup via OAuth.
We're deliberately focused. We're not a billing platform, not a payment orchestrator, not a fraud tool. We're the layer that catches what the upstream tools miss. And because we're focused, we can actually be good at it.
If you want to see how Rekko compares to other dunning tools, we have pages on Churnkey, Stunning, Churn Buster, and Recurly.
The honest caveat
None of these layers will get you to zero involuntary churn. Some customers will genuinely cancel via decline, some cards are truly dead, some issuers will refuse recurring charges no matter what. A well-run stack recovers 70 to 85% of recoverable failures, not 100%. Anyone promising more is selling.
But the difference between a 40% recovery rate (basic email only) and a 75% recovery rate (layered defense with email plus SMS) is often 2 to 4% of MRR back on your P&L. For a $200K MRR business, that's $48K to $96K a year. For a $1M MRR business, it's a quarter million.
That math is why layered defenses beat silver bullets.
Try Rekko free
Plug Rekko into Stripe and see what your dunning safety net could recover.
- Email plus SMS sequences
- 5 minute setup
- Pre-authenticated payment links
- Real-time ROI dashboard
- Flat monthly pricing
Start your 14-day free trial. No credit card required. See pricing for plan details.