Skip to main content

​
Lost Card

Decline code: lost_card Error type: card_error HTTP status: 201 Created (payment status becomes failed asynchronously)

​
What it means

The card has been reported as lost by the cardholder. The issuing bank has flagged the card and will decline all transactions made with it.

​
Why it happens

  • The cardholder reported their card as lost to their bank.
  • The bank proactively flagged the card after detecting suspicious activity.
  • A replacement card has been issued, and the old card number is now blocked.

​
API response

The payment is created with status: "pending". After processing, it transitions to failed with decline details: 
{
  "id": "pay_a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "status": "failed",
  "decline_code": "lost_card",
  "decline_message": "The card has been reported lost."
}

​
What to tell the customer

Your card could not be processed. Please use a different payment method.
Do not tell the customer the card was reported lost. This could alert a fraudster that the real cardholder has noticed the theft. Keep the message generic.

​
What the merchant should do

  1. Show a generic decline message — do not reveal that the card is reported lost.
  2. Do not retry — a lost card will never succeed. The card is permanently blocked.
  3. Do not allow the same card number to be retried in the same session — this pattern is a fraud indicator.
  4. Log the request_id for potential fraud investigation.
  5. Monitor for patterns — multiple lost_card declines from the same IP or customer account may indicate fraud.
  6. Consider additional verification if the customer provides a different card — request 3DS verification or additional identity checks.

​
Fraud considerations

A lost_card decline is a strong signal that the card may be in the hands of someone other than the legitimate cardholder. While this does not mean every lost_card attempt is fraudulent (the real cardholder might not know their card was flagged), treat it with caution:
  • Log the attempt for your fraud monitoring system.
  • If you see multiple lost_card declines from the same source, consider blocking the IP or account.
  • Never reveal the specific decline reason to the end user.

​
Testing

The current Flowlix sandbox only deterministically reproduces the do_not_honor and insufficient_funds decline codes (see Test Cards). To exercise your lost_card handling end-to-end, write an integration test that injects a Payment with status: "failed" and decline_code: "lost_card" into your handler, or file a request to add this code to the sandbox.