Approved by the processor, but every card still declines
This is the single most common problem we get called about. The founder did everything right: applied, got approved, received the API keys, installed a payment plugin. Then every order fails. They assume the website is broken. Most of the time it isn't.
Why approval isn't the same as ready
Card payments involve at least three parties: the gateway (the software your site talks to), the processor, and the acquiring bank that actually holds the merchant account. Gateways issue credentials the moment an account is created. The bank side can lag behind by days. During that gap, your site can connect perfectly and still get a decline on every card.
The 10-minute test
- Log in to your gateway or processor dashboard and find the virtual terminal. It lets you key in a card by hand without your website involved.
- Run one small real charge (a few dollars) on a card you own.
- Read the result:
- Declines there too: it's the account. Email your processor rep and ask whether boarding is complete at the bank. Don't touch the website yet.
- Approves there, fails on your site: it's the integration. Now it's worth looking at the code and settings.
- Void or refund the test charge afterwards.
Signs it's the account, not the code
| What you see | What it usually means |
|---|---|
| Every card declines, including cards that work everywhere else | Account not fully boarded, or not enabled for card-not-present sales |
| Address (AVS) and security code (CVV) checks show “not processed” | The charge never reached the point where the bank checks those details |
| A mix of “declined” and “general error” with no pattern by card | Processor-side setup, not your checkout |
| Virtual terminal fails with the same message | Confirms it: the account, not the site |
Signs it's the integration
- Sandbox and live are mixed up. The site is in test mode with live keys, or the other way round. Both sides must match.
- Old keys still saved. In some plugins, a blank field means “keep the current value,” so a key you thought you replaced is still there.
- The payment option doesn't appear at all. On WooCommerce this is often a checkout-type mismatch. See classic vs block checkout.
- Missing public key. Card fields that tokenize in the browser usually need a separate public client key, not just the API login.
The one that looks like both: fraud filters
Peptide merchants are high risk, so gateway fraud settings are often strict out of the box. Real orders can land in a “held for review” or filtered list and look like declines to the customer. Check that screen before assuming anything else. Loosen rules carefully and with your processor's agreement, since chargebacks are what get accounts closed.
What to send your processor rep
Keep it short and specific so it gets answered the same day:
- Your merchant ID and the date you were approved
- “A virtual terminal charge on [date] declined with [message]”
- “Can you confirm boarding is complete and card-not-present is enabled?”
Why we start every payments job this way
Before we write a line of code, we ask for one virtual terminal transaction. If it fails, we tell you for free that it's the account, because no developer can fix that. It saves founders from paying for “fixes” that can't work. If you want us to look at yours, our $199 audit covers the full checkout, or message us and we'll tell you which side the problem is on.
Frequently asked questions
Why does every card decline right after my merchant account was approved?
Usually because the account isn't fully set up at the bank yet. Payment gateways hand out API credentials as soon as an account is created, but the processor and acquiring bank can take longer to finish boarding. Until they do, real cards decline no matter how good the website code is.
How do I know if it's my website or my merchant account?
Run one small real transaction in your processor's virtual terminal, outside your website. If it declines there too, the problem is the account, and no code change will fix it. If it goes through there but fails on your site, the problem is the integration.
What does it mean when AVS and CVV say 'not processed'?
It usually means the transaction never got far enough for the bank to check the address and security code. Seeing that on every attempt points to an account or boarding problem rather than a typo by the customer.
Can fraud filters block real customers on a peptide store?
Yes. Peptide merchants are treated as high risk, and gateway fraud filters are often set tight. Check the gateway's fraud or held-transactions screen. Real orders can sit there marked as declined or held for review.
Should I keep testing with my own card?
Test once or twice, then stop. Repeated declines on the same card can trigger the bank's own fraud checks and make the problem look worse than it is.
Sources and further reading
Where we can help
We build the whole business: store, payments, email and SMS, SEO, AEO + GEO, and supplier introductions.
See the done-for-you launch →More guides
- How a peptide checkout should work: Tokens, secret keys, refunds and double-charge protection, in plain English.
- The peptide payment backup plan: What to set up before a processor drops you, and what to do if it does.
- WooCommerce classic vs block checkout: Why your card option might not show up, and how to fix it.
- How to start a peptide business: The steps, in order, from business setup to first order.
- Peptide business startup costs: Every cost category, with a calculator that shows its math.
- Peptide supplier due-diligence scorecard: How to vet a wholesaler before you buy inventory.
- SEO vs AEO vs GEO for peptide sites: What each one is, and why peptide brands need all three.
- Peptide business launch checklist: Ten sections to finish before you open.
Written by the PepFounders team. This is general business information, not legal, tax or regulatory advice. Product classification and what you can sell depend on your products and markets, so talk to a licensed attorney.