When credit cards are declined, our gateway usually provides a useful reason: insufficient funds, CVV mismatch, invalid card number, etc.
Should we show this to the user? Or should we just show a generic "Card Declined" error?
Obviously it is far more useful to show granular errors to our users! But, when we talk about user logins, we choose to show less information, as not to leak info about user activity. Does the same concept apply here (in case of someone trying to use stolen credit cards?)