What is a card check?
A card check is any verification step that confirms a payment card is valid, active, and authorized to complete a transaction. It ranges from a simple format test on the card number to a live authorization request sent to the issuing bank. Most real-world card checks combine several signals: number format, expiration date, security code, billing address, and the issuer response.
What do card checks verify?
- Card number validity: the Luhn checksum catches typos and invented numbers.
- Security code (CVV or CVC): a 3- or 4-digit value printed on the card and never stored alongside the number.
- Address Verification Service (AVS): compares the billing street number and ZIP code against issuer records.
- Authorization: the issuer approves, declines, or refers the transaction in real time.
- 3-D Secure: adds a bank-issued challenge or device check before approval.
Why do merchants run a card check?
Merchants run card checks to stop fraudulent orders before goods ship. A failed address or security code check raises the fraud score, which can trigger manual review or an outright decline. Card checks also reduce chargebacks, because approved transactions with matched verification data are harder to dispute successfully.
Card Verification Process: How CVV and AVS Checks Work
What is a zero-dollar card check?
A zero-dollar authorization reserves no funds but still asks the issuer to confirm the account is open. Hotels, rentals, and subscription services use it to validate a card before the first real charge.
What is card checking fraud?
Card checking fraud is the practice of running small or zero-value tests against stolen card numbers to find accounts that still work. Fraudsters then use the surviving numbers for larger purchases. This testing produces distinctive patterns that fraud systems flag, such as many low-value attempts from one device or one IP range.
How do merchants detect card checking attacks?
Detection depends on velocity and pattern analysis. Red flags include dozens of small authorizations within minutes, a cluster of declines from a single IP address, mismatched billing data, and sequential card numbers. Machine learning models score those signals and block the session before a valid card is used.
How can consumers protect themselves?
- Review statements for small unfamiliar charges, which often precede larger fraud.
- Use virtual or single-use card numbers on sites you do not fully trust.
- Turn on transaction alerts and freeze the card immediately if a test charge appears.
- Never buy or share card data from unofficial sources; stolen card data cannot be used safely or legally.
Is buying or selling card data legal?
No. In the United States, trafficking in stolen payment card data violates 18 U.S.C. § 1029, which covers fraud and related activity involving access devices. Penalties can include heavy fines and prison time, and card networks and issuers cooperate with law enforcement investigations. Consumers who spot card checking activity on their accounts should report it to the card issuer and to the FTC.