Why sports betting deposits get declined, and the honest fixes

Sports betting deposits get declined mostly for reasons that have nothing to do with fraud: the issuer does not approve gambling transactions on that card, the card is a credit card in a state or at an operator that does not accept them, the player has hit a daily limit, or the data on the deposit does not match what the bank holds. Operators raise approval rates honestly by coding correctly, sending clean data, blocking funding they are not allowed to take, and giving players a bank transfer option that does not depend on a card issuer's gambling policy.

What does not work, and gets accounts closed, is disguising the transaction. Everything below stays inside the rules.

Start with the decline code

Every declined authorization comes back with a response code from the issuer, passed through by your processor. Grouping those codes is the first job, because each group has a different fix. "Do not honor" (05) is the issuer saying no without saying why. Insufficient funds (51) and limit codes are about the player's balance or daily cap. "Transaction not permitted" (57) usually means the issuer does not allow this kind of purchase on the card at all, which for a sportsbook often points to a gambling policy.

Retrying is where operators get hurt. Visa groups decline codes into categories and charges fees when merchants reattempt the ones that will never approve, or reattempt the others too many times in a set window. Mastercard charges for retrying after a "do not try again" merchant advice code. Ask your processor which retry rules apply and build them into your deposit logic.

A player who fixes a typo and tries again is fine. An automated loop that hits the same card over and over is not, and it also makes your merchant look like a card-testing target to issuers.

Issuer policy on gambling transactions

Issuers see the merchant category code on every authorization. For a licensed US online sportsbook registered with the card networks, that is normally 7801, the US code for licensed online gambling, rather than 7995, the general betting code. Regulation GG, the federal rule that implements UIGEA, names this kind of coding as one way card systems can meet the rule: it lets the issuer identify and deny transactions that may be tied to unlawful internet gambling.

So issuers can see a deposit is gambling and decline it if they choose. Some decline internet gambling on some or all of their cards, some approve on debit but not credit, and card agreements at some large banks reserve the right to decline any transaction identified as internet gambling.

No retry changes an issuer's policy. The honest responses are to tell the player clearly that their bank declined a gambling transaction and to offer another approved method in the same screen. A plain message such as "your bank declined this deposit, you can pay by bank transfer instead" gives the player a next step that a generic error code does not. If a player says they asked their bank to block gambling, point them to your deposit limits and self-exclusion tools, not to another payment method.

The dishonest response is to change the code. Processing a sportsbook under a non-gambling MCC to slip past issuer filters is miscoding, and it is a direct route to termination and a MATCH listing. Our gambling MCC guide explains why, and Visa and Mastercard rules for gambling merchants covers what your acquirer has to check. The federal side is in our post on UIGEA and Regulation GG.

Credit cards: state bans and the operator retreat

Some failed card deposits are credit cards you are not allowed to take. As of October 2026, several states bar credit card funding for sports wagering. Some examples:

• Massachusetts. The sports wagering statute says an operator shall not accept a credit card (G.L. c. 23N, section 13), in the same subsection that bars wagers from anyone under 21. In July 2025 the Gaming Commission fined DraftKings $450,000 after credit card money reached 1,160 wagers placed in the state.
• Iowa. State law bars licensees from accepting credit cards for sports wagering, and the Racing and Gaming Commission has fined several operators over credit deposits, including a 2025 case where a digital wallet's credit line had been left available as a funding option.
• Tennessee. The state's rules require that every approved funding method be able to separate and prevent funding that originates from credit cards, which reaches wallets and other indirect routes.
• Virginia. A 2026 law removed credit cards from the approved funding methods for sports betting accounts, effective July 1, 2026.

The Massachusetts decision is worth reading for one detail. The problem was not credit deposits made in Massachusetts. It was credit card money deposited while players were in other states, sitting in a single national wallet, and then wagered in Massachusetts. The handle involved was about $83,668, against a $450,000 fine. Massachusetts regulations bar credit card use "either directly or indirectly," and Tennessee's rule says credit card funds in a global or single wallet must be kept separate from use in the state. If your wallet follows the player across state lines, tag every deposit with its funding type and keep credit-sourced balances out of wagers in ban states.

Other states have similar rules. Illinois banned credit cards for sports wagers and account funding by a rule that took effect in October 2025, and Ohio's regulator has proposed a similar ban. Operators have moved faster still. DraftKings stopped taking credit card deposits nationwide in August 2025, and trade press reports that FanDuel, BetMGM, bet365 and Caesars followed in the first half of 2026.

The practical job is funding-source control. Use your processor's card BIN data to tell credit, debit and prepaid cards apart before you authorize, block credit wherever your license requires it (or everywhere, if that is your policy), and check what can sit behind each wallet you accept. A blocked credit card is not a lost deposit if the same screen offers debit and bank transfer. State credit card rules change often, so confirm current rules with counsel and each regulator.

Cash-advance treatment and the disputes it creates

Where credit cards are still allowed, many issuers treat a gambling charge as a cash advance rather than a purchase. That usually means a cash advance fee and interest from the day of the transaction, with no grace period. Senator Elizabeth Warren's letters to sportsbooks said card-funded wagers are almost always classified as cash advances, and cited a Consumer Financial Protection Bureau finding that sportsbooks give limited or no disclosure of those fees.

For operators, the cost shows up later. A player who finds an unexpected fee on a small deposit often calls the bank, and that call can become a dispute. If you still accept credit anywhere, tell players before they deposit that their issuer may treat it as a cash advance. The cleaner choice, which most large books have made, is to stop taking credit and steer players to debit and bank transfer.

That choice also fits responsible gambling. Betting with borrowed money is exactly what the state bans target, and deposit limits and cooling-off tools work better when the funding is the player's own money. See responsible gambling payment controls for how limits and self-exclusion fit into the deposit flow.

Issuer fraud models and new-player risk

Issuer risk models look hardest at transactions that are routine for a sportsbook: a first purchase at a new merchant, from a new device, often late at night or during a big game, sometimes for more than the cardholder usually spends. Those are legitimate deposits that look a lot like card testing or account takeover.

You can make legitimate deposits look legitimate. Send full address and CVV data so issuers can match it. Keep the billing descriptor accurate and recognizable, with your brand name and a support contact, so the player and the bank both know who charged the card. Start new players with modest deposit limits that rise with verified history, which also supports responsible play.

Then stop real attacks yourself. Bursts of small attempts across many cards from one device are card testing, and your own fraud rules should catch them early. Unchecked card testing inflates your decline rate, can draw network fees for excessive authorization attempts, and makes issuers more cautious with every real player behind it.

3-D Secure: what it does and does not do for gaming

3-D Secure, branded as Visa Secure and Mastercard Identity Check, lets the issuer authenticate the cardholder during checkout. Often it runs invisibly through a risk-based "frictionless" flow, and sometimes it asks for a one-time code or an app approval. The issuer gets far more data about the device and session than a plain authorization carries, which can help a cautious issuer approve a deposit it would otherwise decline.

The limit is liability. In most card-not-present commerce, an authenticated transaction shifts fraud chargeback liability to the issuer. For US gambling that assumption is risky: processor and wallet documentation lists MCCs 7995, 7801 and 7802 among the US categories excluded from Visa's authentication liability shift. Ask your acquirer which liability rules apply on each network before you count on them.

Acquirer notices also say Mastercard now monitors whether gambling merchants verify or authenticate card transactions, through CVV, 3-D Secure or authenticated network tokens. So the case for 3-D Secure in US gaming is approvals, network expectations and evidence, not insurance. Test it: run authentication on first deposits and larger amounts, compare approvals and abandonment against a control group, and keep whichever setup completes more deposits. The authentication record is also useful when you answer disputes, which our gaming chargebacks guide covers.

Account-name matching and clean data

A sportsbook knows more about its player than most merchants do: verified legal name, date of birth, address, and location at the moment of the deposit. Use it. When the name on the card or bank account matches the verified player, the deposit is cleaner for the issuer, for your AML program and for the payout that follows.

• Accept funding only in the player's own name. Third-party cards and accounts drive both fraud and "I didn't authorize this" disputes. Many operators make this a hard rule.
• Prefill billing data from KYC. Fewer typed fields means fewer address and CVV mismatches.
• Validate bank accounts before the first debit. Nacha requires originators of online debits to validate a new account number as part of a commercially reasonable fraud detection system.
• Use name-match results where your providers return them. Treat a mismatch as a reason to ask the player, not an automatic block, since married names and nicknames are common.
• Cap the number of cards per account. A player cycling through many cards is a signal worth a review.

For what processors expect your identity stack to cover, see KYC, age verification and geolocation for gaming.

Offer bank transfer and other approved methods

The biggest approval lever is not on the card rail at all. A bank transfer from a checking account does not ask a card issuer's gambling policy for permission, and card daily limits do not apply to it. Most licensed sportsbooks now present bank transfer alongside debit cards.

ACH has its own rules. An online consumer debit is a WEB entry, and Nacha's account validation rule for WEB debits, mentioned above, has applied since March 2021. Its risk management rules, which took effect in two phases in March and June 2026, also require originators, third-party senders and banks to keep risk-based processes for spotting entries that are unauthorized or authorized under false pretenses.

Returns are the risk to manage: insufficient funds (R01) is the common one, and a consumer can claim a debit was unauthorized (R10) for up to 60 days after settlement. One control to consider is letting players wager with ACH-funded balances while holding withdrawals of those funds until the deposit has cleared.

Whatever you add has to be on your regulator's approved list for each state. Our ACH for gaming guide covers return codes, return rate thresholds and timing in detail.

What not to do

Every decline problem has a shortcut that ends the account. The common ones:

• Processing deposits under a non-gambling MCC, or through another merchant's account, which is transaction laundering.
• Changing descriptors to hide that the merchant is a sportsbook.
• Splitting one deposit into smaller charges to get under an issuer or player limit.
• Automated retry loops on declines that will never approve.
• Taking deposits from players outside permitted states, or tolerating geolocation workarounds.
• Letting credit in through a wallet or card type you have not checked.

Each of these can mean regulator fines, network assessments, termination by the acquirer, and a MATCH listing that follows the business and its owners to the next application. An approval rate built this way does not last.

Measure approval rates the right way

A single approval rate hides the story. Break it down so each fix has a number attached:

• By funding type: credit, debit, prepaid, ACH and wallet.
• By issuer or BIN range, to spot banks with gambling policies.
• By state, since funding rules differ.
• First deposit versus repeat deposit.
• By amount band, to find limit-driven declines.
• By decline category: policy, risk, balance and data errors.

Then measure what matters to the business: completed deposits per player who tried, not authorizations per attempt. A player declined on a card who succeeds by bank transfer a minute later is a success. Leave out declines your own controls created on purpose, such as deposit limits, self-exclusion and blocked credit cards. Those are the system working.

How Flux fits

Flux reviews gaming and betting businesses case by case, and approval depends on your licenses, where your players are, and your controls. Not every business qualifies, and gaming and betting accounts are priced after underwriting.

For approved merchants, the pieces that matter most here are ACH bank transfers alongside card processing, hosted payment fields and tokenization that keep card numbers off your servers, and fraud detection that scores each transaction in real time and flags or blocks risky ones before they settle, using rules you control. Cards settle in 1-2 business days and ACH in 1-3. KYC, geolocation and responsible gambling tools stay yours to run, with the vendors you choose.

This article is general information, not legal advice. To talk through how your deposits move, apply at fluxpayments.com/apply.html or email sales@fluxpayments.com. More guides in this series are on the gaming and betting hub.