A card verification utility is software that checks card data against issuer records and returns a result code. It answers three questions: is the card number well formed, does the security code match, and does the billing address match. It does not confirm that an account is open or holds funds. Only an authorization request does that.
What the utility checks
- Card number format. The Luhn algorithm tests the digits for a valid checksum. A typo fails. A guessed number can pass.
- Issuer and card type. The first six to eight digits, the BIN, map to a bank, a brand, a card class, and a country.
- Security code. Visa, Mastercard, and Discover print three digits on the card. American Express prints four. The code sits on the card and is not encoded in the magnetic stripe.
- Address. AVS compares the street number and ZIP code on the order with records the issuer holds.
- Cardholder authentication. 3-D Secure sends the buyer to the issuer for a password or a one-time code.
Result codes
Issuers return codes such as match, no match, not supported, or unavailable. A no-match result can come from a move, a new ZIP code, or a typo. Merchants set rules for which codes block an order. Cards and codes belong to the cardholder. Under 18 U.S.C. 1029, trafficking in card numbers or access devices is a federal crime, with prison terms that scale by card count and dollar loss. PCI DSS Requirement 3.2 bars merchants from storing the security code after authorization. A verification service that runs with no contract between the merchant, the acquirer, and the card brand operates outside those rules.
Free checks and issuer checks
The Luhn check is public and free. It catches typos. Issuer authorization is the only step that confirms an account exists and can hold a charge. A zero-dollar authorization tests a card and reserves no funds.