A credit card verification scheme is the combined set of checks a merchant and the card issuer run before approving a payment: CVV or CVC validation, address verification, 3-D Secure authentication, and issuer risk rules. Each layer answers a different question, and together they decide whether a transaction is approved, declined, or sent back to the cardholder for another step.
Card Check Routine: How to Verify a Payment Card in 5 Steps
What a verification scheme checks
Most schemes stack several independent checks rather than relying on any single one. The common layers are:
- Card number validity. A checksum (the Luhn algorithm) catches mistyped digits before the request ever reaches the issuer.
- Expiry date. An expired card is declined outright, no further checks needed.
- CVV or CVC match. The three- or four-digit code is compared with the value the issuer holds on file.
- Address Verification Service (AVS). The numeric parts of the billing street address and ZIP code are compared with the issuer's record.
- 3-D Secure. The cardholder completes an authentication step with the issuer, such as an in-app approval or a one-time code.
- Risk and velocity rules. Issuers and processors score the transaction against patterns like frequency, geography, device, and merchant category.
Where the CVV fits
The card verification value is a short code printed on the card but not encoded in the magnetic stripe or chip data. Because it is not part of the track data, a merchant that only sees a swiped or dipped card never receives it, which is why online merchants ask for it as a separate field. Under PCI DSS, the value must not be stored after authorization. That rule exists because the code is only useful as evidence that the person entering it had the physical card in hand.
Refusal: Credit Card CVV Purchase Guide Not Permitted
3-D Secure and step-up authentication
3-D Secure moves part of the decision to the issuer. Instead of approving on card data alone, the merchant embeds an authentication step where the cardholder confirms the purchase with their bank. Modern versions, known as EMV 3DS, run largely in the background and only prompt the cardholder when risk is elevated, which keeps friction low for ordinary purchases while adding a check on suspicious ones.
Merchant obligations and the limits of verification
Running these checks does not make a merchant compliant or fraud-proof. PCI DSS governs how card data is stored, transmitted, and accessed; the verification scheme governs whether a given transaction is approved. A successful CVV and AVS match still leaves room for chargebacks, so merchants usually pair verification with order review, delivery confirmation, and clear refund policies.
If a card is used without authorization
Contact the card issuer immediately, since most banks let you freeze a card from their app, then report the fraud to the FTC through IdentityTheft.gov. Buying, selling, or possessing stolen card data is a crime in the US and most other jurisdictions. Legitimate verification happens inside the payment networks, performed by merchants and issuers, not by third parties trading card numbers.