What a card validation toolset is
A card validation toolset is a group of checks that run on payment card data before a transaction reaches the issuer. The toolset confirms that the number is structurally possible, that the expiry date has not passed, and that the security code has the correct format. It does not confirm that the card is open, funded, or tied to the person who typed it. Those questions belong to authorization and fraud screening, which are separate steps in the payment flow.
Checks a typical toolset performs
- Length and character check: the number holds only digits and falls inside the length range for its brand, usually 13 to 19 digits.
- Luhn checksum: a mod-10 formula catches single-digit typos and swapped digits.
- BIN or IIN lookup: the first six to eight digits identify the issuer, the brand, and often the card type, such as credit, debit, or prepaid.
- Expiry check: the month and year must be present and must not be in the past.
- CVV format check: three digits for most brands, four for American Express. The value goes to the issuer for verification and is never stored.
- Address and postal code format: AVS checks compare the billing address against records held by the issuer.
Prerequisites
- A sandbox account with a payment processor.
- The processor's published test card numbers. Sandbox tools reject invented numbers.
- An HTTPS endpoint. Card data sent over plain HTTP fails PCI DSS and processor requirements.
- A written data flow that shows where card data is captured, forwarded, and deleted.
How to run validation in a test environment
- Open your processor's sandbox dashboard and copy the test card numbers for every brand you plan to accept.
- Build form fields for the card number, expiry, and security code, and set each input to text with numeric hints. Do not use a password field.
- Send the entered number through a Luhn check on the client side to catch typos before any network call.
- Call your processor's tokenization endpoint with a test number and read the response code.
- Log the brand, the last four digits, and the BIN, and never the full number or the security code.
- Trigger one declining test card and one expired-card case, then confirm your form shows a generic error that does not reveal which check failed.
- Submit a number that fails the Luhn check and confirm the form blocks the submission.
- Review your logs to verify that no full card number or CVV value was written to disk, a cache, or an analytics tool.
What validation cannot do
Format checks never prove ownership, available funds, or issuer approval. A number can pass every structural test and still be declined, closed, or reported stolen. Authorization answers those questions, and fraud scoring answers whether the person at the checkout is the account holder.
Credit Card Testing Service Guide
Ownership matters as much as the code. Test cards from your processor exist for this exact purpose. Running validation checks against card numbers you do not own or have written permission to test is payment card fraud in the United States and most other jurisdictions, and merchant accounts caught doing it are terminated.
Card Checking Utilities and CVV Sales: Request Declined
CVV verification deserves its own rule. PCI DSS forbids storing the security code after authorization, in any form, including hashed or encrypted. A toolset should validate the format in memory and pass the value straight to the issuer.