Quick answer

Checkout card verification is a set of checks a payment processor runs between the moment a card number is entered and the moment a charge is approved. The checks cover the card number, the expiration date, the security code, the billing address, and in many cases a bank authentication step. Each check returns a pass, a fail, or a not-checked code. The processor then applies the merchant's rules and the issuer's response.

cvv verification checkout

The four checks

1. Card number and expiration. The gateway validates the number against the Luhn algorithm and confirms the expiration date has not passed.
2. Card verification value. The CVV is a 3-digit code on the back of most cards, or a 4-digit code on the front of American Express cards. The issuer compares the submitted value to its record. This check ties the transaction to the physical card.
3. Address Verification Service (AVS). AVS compares the billing street address and ZIP code entered at checkout to the address on file with the issuer. The response returns separate codes for the street line and the postal code.
4. Issuer authentication. 3D Secure, sold as Verified by Visa and Mastercard Identity Check, sends the buyer to the issuing bank for a password, a one-time code, or a biometric check.

CVV response codes

The issuer returns one of four values: match, no match, not processed, or not supported. A no-match response often triggers a decline on card-not-present orders. The security code is never stored by a compliant merchant after authorization.

cvv test payment gateway

AVS response codes

AVS returns a letter or number code. Common results are full match on both street and ZIP, ZIP-only match, street-only match, and no match. Merchants set their own thresholds. A gas station may accept a ZIP-only match. A high-value electronics order may require a full match.

CVV Test Payment Gateway

3D Secure outcomes

The bank returns authenticated, attempted, or not authenticated. Liability for certain fraud chargebacks shifts to the issuer when authentication succeeds. The tradeoff is added friction at checkout.

cvv test payment gateway

Tokenization

Card networks replace the 16-digit number with a network token. The token is bound to the merchant, the device, or both. Tokens cut the number of places a real card number exists in a merchant's systems.

Why a card fails verification

• Transposed digits in the card number.
• Expired card.
• Mismatched billing address, a frequent cause when a buyer has moved.
• Incorrect security code.
• Issuer block on the card or on the merchant category.

Stored data rules

PCI DSS prohibits retaining the full magnetic stripe data, the CVV, and the PIN block after a transaction is authorized. Merchants that keep these values are out of compliance. The remaining stored data, such as the last four digits and the expiration date, must be encrypted or masked.