A card verification check confirms that a card number, expiration date, and security code belong to the same live account and that the person presenting them controls that account. Merchants, issuers, and payment processors run these checks at checkout and during authorization. This guide covers the legitimate side of that process. It does not cover sourcing card numbers, and it will not help anyone buy them: trafficking stolen account data is a federal crime in the United States, and the marketplaces that sell it are the ones payment networks and law enforcement monitor most closely.

read more

What a verification check actually tests

• Security code match. The three-digit value on the back of most cards (four digits on the front of American Express) is compared against issuer records. A mismatch usually means a mistyped number or a card that was not physically present.
• Address and postal code. Address Verification Service compares the billing street number and ZIP code you supply with what the issuer holds.
• Issuer authentication. Step-up flows such as 3-D Secure push a one-time code or a biometric prompt to the cardholder's device.
• Authorization. The issuer approves, declines, or refers the transaction, and returns a response code the merchant can log.

Who runs the check, and when

Verification happens in layers. The payment gateway formats the request, the acquirer routes it through the card network, and the issuing bank makes the final call. Online merchants often add their own risk rules on top: velocity limits per IP address, device fingerprinting, and manual review for orders that fail a check but still look plausible. A single failed check is rarely proof of fraud, and a single passed check is rarely proof of legitimacy. That distinction matters because attackers who test many card numbers in quick succession produce a pattern of small declines that looks nothing like normal customer behavior.

card verification test tool

Where the data is allowed to live

The PCI Data Security Standard treats the security code as sensitive authentication data. It may be used to process a transaction but must not be stored after authorization, even in encrypted form. That single rule shapes how legitimate systems are built: the code is passed through, used, and discarded, while the card number itself is replaced with a token that has no value outside one merchant's environment. If a system offers to keep codes on file for convenience, that system is out of compliance.

more on this topic

Patterns that signal card-number trafficking

• Sellers advertising bulk card data with guaranteed approval rates or refunds for dead records.
• Tools marketed as validators or checkers that test numbers against gateways at volume.
• Payment demanded only in irreversible cryptocurrency with no merchant of record.

Buying into any of these exposes the buyer to prosecution under federal access device statutes, account seizure, and placement on network-terminated-merchant lists that effectively end the ability to accept cards.

Card Verification Number Test: Safe CVV Validation Guide

FAQ

Is checking whether a card is valid legal? Only when you are the merchant, the cardholder has authorized the charge, and the check is part of a real sale. Running purchased or generated numbers through a gateway is card testing and is criminal.

Can a merchant store the security code? No. It can be used during authorization and must be deleted afterward.

What does a failed verification mean? Usually a typo, a moved cardholder, or a bank rule. Treat repeated failures from one source as a fraud signal and hand the order to manual review.