I've replicated this issue on my demo site. The "invalid card" message is coming back from a.net, but isn't getting posted to the One-Page Checkout's data-gathering page. I'll note this as an issue in the plugin's GitHub repository; it might take me a couple of days for resolution.
We were lucky and "dodged the Irma bullet" with just a couple of trees and a lot of branches down.
OK, so a couple of days turned into a couple of weeks. Looking at this issue, I'm starting to form the opinion that it's a base Zen Cart issue with the AJAX confirmation. When the 'invalid card' message is received, the AJAX processing is redirecting back to the checkout_payment page for the display instead of returning the information "in-line" on the AJAX call.
Just in case it's my setup, would you verify that you don't receive the message when One-Page Checkout is disabled (i.e. going through the standard, 3-page version)?
I've just submitted v1.4.1 to the Zen Cart plugins for review, containing the changes associated with the following GitHub issues:
#100: Update "Troubleshooting" section in readme.
#101: Display errors from payment modules that "collect credit-card data onsite".
#102: Correct display of confirmation page for payment modules that "collect credit-card data onsite".
I'll post back here once it's been approved.