Authorisation vs. approval rate in European ecommerce: what’s the difference

Every online card payment in Europe passes through two separate decisions. The issuing bank decides whether to authorise the payment, and the merchant decides whether to approve the order. Authorisation confirms that the payment can happen. Approval confirms that it should. Under PSD2, a third step sits between the two for many orders: strong customer authentication (SCA), which verifies that the shopper is the genuine cardholder. This guide explains how the three steps fit together, how to measure each one, and how European merchants can send issuers better data to lift authorisation rates.

Key takeaways

• Authorisation is the issuer’s decision on whether a payment can proceed. Approval is the merchant’s decision on whether to fulfil the order.
• SCA and 3D Secure authenticate the shopper. They are not the same as authorisation, and passing SCA does not guarantee that the issuer will authorise the payment.
• Issuers decide with limited data. According to our data, 15% of orders are falsely declined for authorisation by banks.
• Screening orders before authorisation lets merchants stop obvious fraud early and give issuers the context they need to approve more genuine shoppers.

What is transaction authorisation?

Transaction authorisation is the issuing bank’s decision to accept or decline a payment once the shopper selects “Pay”. The request travels from the merchant’s gateway or acquirer through the card scheme to the issuer, which returns either an authorisation code or a decline.

How does authorisation work in Europe?

The issuer checks several things before it responds:

• The card is valid and has not been blocked, reported lost or reported stolen
• The account holds enough funds or available credit
• The payment does not trigger the issuer’s own fraud rules, including location and spending pattern checks
• SCA has been completed, or a valid exemption applies, where PSD2 requires it

That last check is specific to Europe. SCA applies to electronic payments initiated by the payer, subject to a set of exemptions. The EBA and ECB report that in 2024 only 40% of electronically initiated card payments were SCA-authenticated by number of transactions, partly because contactless payments at the point of sale can be made without it. For online orders, the issuer decides whether to challenge the shopper, typically through 3D Secure, or to accept an exemption requested by the merchant or its PSP.

If the checks pass, the issuer places a temporary hold on the funds and sends an authorisation code back to the merchant. The money moves only when the merchant captures it after fulfilling the order. If any check fails, the payment is declined.

Example: A shopper in Milan tries to buy a €1,200 handbag from a Luxury & Jewellery retailer. The card is valid and SCA is completed, but the account holds only €1,000. The issuer declines the request and never issues an authorisation code, so the order does not reach the merchant’s approval stage.

What is transaction approval?

Authorisation happens on the bank’s side. Approval happens on the merchant’s side. After receiving the authorisation code, the merchant decides whether to accept the order, fulfil it and capture the funds.

How does approval work?

Approval is where the merchant applies a deeper review. Fraud signals such as shipping and billing details, device data, geolocation and purchase history carry most weight, and operational factors such as stock availability also play a part. If the order clears the merchant’s review or fraud management solution, the merchant approves it and captures the funds. If the merchant voids the order or misses the capture window, the authorisation hold expires and the funds return to the shopper.

Fraud liability also matters here. PSD2 Article 74(2) states that where the payee or its payment service provider fails to accept SCA, it must refund the financial damage caused to the payer’s provider. In an answer published by the EBA, the European Commission adds that if the payee’s provider triggers an SCA exemption and the payment is carried out without SCA, the payee’s provider is liable to the payer’s provider for the financial damage caused. The answer is an unofficial opinion, and card scheme rules and acquirer contracts also apply, so merchants should confirm how this liability is passed on to them.

Example: a customer in Lyon orders a €140 pair of trainers. The issuer completes its checks, SCA succeeds and an authorisation code comes back. The merchant’s fraud system then reviews the delivery address, device, location and order history. Everything is consistent, so the merchant approves the order.

Authorisation vs. approval: understanding the difference

In short, authorisation is the bank confirming that a payment can happen, and approval is the merchant confirming that the order should go ahead.

Where does SCA fit?

Strong customer authentication (SCA) is an authentication step, not a decision about the order. It checks that the cardholder is who they claim to be. The issuer then still decides whether to authorise the payment, and the merchant still decides whether to approve the order. Merchants and PSPs can ask for an exemption where the transaction qualifies. One of the most important is transaction risk analysis (TRA), which the Regulatory Technical Standards on SCA allow only while the provider’s fraud rate stays at or below set reference rates: 0.13% for remote card payments up to €100, 0.06% up to €250 and 0.01% up to €500. In 2024, around 29% of remote card payments without SCA were exempted under TRA, the most commonly applied exemption for remote card payments in scope of SCA.

How to measure authorisation and approval results

Once you understand the difference between the two decisions, the next step is to measure how each one performs.

Authorisation rate

The authorisation rate is the percentage of payment requests that issuers authorise. Small movements matter. Take a hypothetical European footwear retailer that processes 250,000 online orders a month with an average order value of €80. A one percentage point rise in authorisation rate means 2,500 more orders go through, which adds €200,000 in monthly revenue.
Measure the rate by issuer country, card type and whether SCA was applied. Splitting the data this way shows whether declines come from specific markets, from cross-border orders or from payments that were challenged and abandoned.

Approval rate

The approval rate is the share of bank-authorised orders that the merchant moves forward. A healthy level varies by vertical, product mix and risk appetite. A sustained fall usually points to fraud rules that are too strict or to a growing backlog in manual review. Both turn authorised, paid-for demand into lost sales.

Fraud and chargeback rate

The chargeback rate tracks the share of approved orders that later return as fraud disputes. A rising rate shows that fraud is passing through the approval stage. A rate close to zero can mean that fraud rules are too aggressive and that genuine customers are being refused.
Market-wide data gives useful context. The EBA and ECB report that EU and EEA card fraud was €1.3 billion in 2024, a fraud rate of 0.033% by value. Remote card payments made up about 28% of card transaction value and 18% by volume, yet accounted for around 83% of card fraud. Online merchants are therefore working in the part of the card market where fraudsters concentrate their activity.

How traditional authorisation processes affect European merchants

Pre-authorisation screening links the limited checks that issuers run with the richer context that merchants hold. Instead of sending every request to the issuer with minimal detail, merchants route orders through an optimisation solution such as Signifyd’s Payment Optimisation first. This lets merchants:

• Stop obvious fraud early. Orders that carry enough warning signs to be flagged by machine learning models are filtered out before they reach the issuer, so the merchant does not pay authorisation fees on payments that were certain to fail.
• Send cleaner traffic to issuers. When issuers consistently see lower-risk orders from a merchant, they have more reason to authorise the card-not-present payments that follow.
• Share richer data with issuers. According to Signifyd, approved orders reach the issuer with data points including the order score and decision, IP address, device ID, email address, geolocation, phone number and shipping details. Our guide to the merchant-issuer data model explains how this reduces false declines.
• Support SCA and exemption decisions. Signifyd’s EMEA platform includes dynamic exemption management, which identifies orders that qualify for an SCA exemption under PSD2.
• Protect the shopper experience. When fraud checks run only after authorisation, bots and bulk resellers can still take limited stock. Earlier screening keeps more of it available for genuine customers.

Pre-authorisation does not replace the issuer’s decision. It gives the issuer more to base that decision on, and it gives the merchant more control over the orders that reach it.

Turn more authorisations into approvals with Signifyd

Each order that is declined at the wrong stage costs a sale, and each fraudulent order that passes costs a chargeback. Signifyd’s Payment Optimisation filters fraud before authorisation, sends cleaner traffic to issuers and shares the data that gives them confidence to raise authorisation rates by as much as 3%, according to Signifyd.

To see Signifyd at work with a European retailer, read how Mango approves more good orders and reduces false declines.

Payment optimisation

Increase approval and recover lost revenue

Apply strong customer authentication (SCA) exemptions and 3D Secure (3DS) intelligently to every transaction, while sharing enriched data with issuers to reduce avoidable false declines and unlock more approved orders.

Learn more

FAQs