Is 43 different from 41 in how I should handle it?

Not from an integration standpoint — both are permanent declines, both are capture responses, and both should be surfaced to the customer as a generic failure. The distinction matters to the issuer and to any fraud investigation, not to your retry logic.

ISO 8583 response code: 43

The card has been reported stolen and the issuer is instructing that it be retained. Final, and never worth retrying.

Stolen cardHard decline

Retrying the same request will fail the same way.

What it means

The counterpart to 41: the issuer holds a stolen-card report against this number and declines every transaction on it. It is a capture response, so the instruction is to retain the card at a card-present terminal, and the reason is not to be disclosed to the person presenting it. Online, it is simply a permanent decline.

Common causes

The cardholder reported the card stolen.
The issuer's own fraud investigation classified the card as compromised and flagged it accordingly.
A stored credential still charging a card number that has since been reported.

How to fix it

Treat it as permanent. Remove the stored credential and do not retry.
Present a generic decline message to the customer, never the specific reason.
In card-present retail, follow your acquirer's documented procedure and do not confront the customer.

Tools that help

ISO 8583 message parser

Frequently asked questions

Is 43 different from 41 in how I should handle it?: Not from an integration standpoint — both are permanent declines, both are capture responses, and both should be surfaced to the customer as a generic failure. The distinction matters to the issuer and to any fraud investigation, not to your retry logic.