Credit card verification is the set of checks a merchant or card issuer runs to confirm that a card number is valid and that the person paying is allowed to use it. It combines data checks on the card itself (number, expiry, security code, billing address) with issuer checks such as 3D Secure. A payment passes only when every required check returns a match.
What does credit card verification check?
Most online payments run four to six checks at once. Each one looks at a different signal, and a failure at any step can stop the order.
- Card number structure. The first digits identify the card network and the issuing bank. A checksum (the Luhn algorithm) catches most typing errors before a request reaches the bank.
- Expiry date. An expired card gets declined even when the number itself is correct.
- Security code (CVV2 or CVC2). A three or four digit code printed on the card that is not held in the magnetic stripe or the chip.
- Address Verification Service (AVS). The numeric part of the billing address and the ZIP code are compared with what the issuer has on file.
- 3D Secure. The cardholder confirms the purchase in a bank app or with a one time code.
- Risk scoring. Order value, shipping country, device, and account history feed a score that can trigger a manual review.
Where is the CVV on a card and what does it mean?
The CVV (card verification value) is the short security code that shows the physical card is in hand. Visa calls it CVV2, Mastercard calls it CVC2, American Express calls it CID, and Discover uses card identification number. Same job, different labels.
CVV1 versus CVV2
CVV1 is encoded on the magnetic stripe and read by a terminal during a swipe. CVV2 is the printed code used in card not present transactions. The printed code is derived from the card number, the expiry date, and a secret key held by the issuer, so it cannot be calculated from the number alone.
How does address verification work?
AVS compares the billing address a buyer types with the address the issuer has on file. The bank sends back a short response: full match, partial match (street matches but ZIP does not, or the reverse), no match, or not supported. Merchants set their own rules, so many accept a partial match for digital goods and reject any mismatch on large physical shipments.
AVS works best in the US and Canada. Issuers in many other markets return not supported, which is why merchants in those regions lean on 3D Secure instead.
What is 3D Secure and when does it appear?
3D Secure is the extra step that sends a shopper to the bank during checkout. Verified by Visa and Mastercard Identity Check are the branded versions. Confirmation comes from a fingerprint, a face scan, or a code sent to a phone.
The bank decides when to challenge. Small payments to a known merchant often pass with no prompt. A new device, an unusual location, or a larger amount triggers one. Fraud liability shifts to the issuer once authentication succeeds, which is why merchants push for it.
Why do valid cards fail verification?
Most declines on a real card come from small data mismatches, not from a stolen card. Check these before calling the bank.
- The billing address on the order does not match the address the issuer holds, often after a move.
- The card is not enabled for online or cross border purchases.
- The CVV was mistyped, or the buyer read the code from a different card in the same wallet.
- The order was placed through a VPN that puts the buyer in a country the issuer flags.
- The card hit a spending limit or a velocity rule on repeated attempts.
How does verification differ in a store versus online?
At a terminal, the chip or tap generates a cryptogram that is unique to that transaction, and a clerk can check the card and the signature. Online there is no card to inspect, so the merchant relies on the CVV, AVS, and 3D Secure. That gap is why card not present fraud costs more than in store fraud.
Why do subscription renewals skip the CVV?
The code is required only on the first authorization. Once the merchant holds a token and the issuer has approved a recurring agreement, later charges run without it. Storing the code would hand attackers everything they need in a breach, so the rules forbid it.
How do you protect the CVV on your own card?
Treat the printed code like a password. Anyone who has the card number, the expiry date, and the CVV can attempt a card not present purchase.
- Never type the code into a chat, an email, or a message from a caller who claims to be from the bank or a support desk.
- Confirm the checkout page belongs to the merchant and uses HTTPS before entering card data.
- Use virtual card numbers from your bank for subscriptions and unfamiliar sites.
- Cover the code when you hand the card to a server or a cashier.
- Read statements for small test charges, which often come before a larger fraudulent one.
What should merchants do with verification data?
PCI DSS forbids storing the CVV2 after authorization, even in encrypted form. Merchants keep the authorization result and replace the card number with a token, so a breach exposes nothing usable.
Clear decline messages help real customers fix a typo without telling a fraudster which field failed. Pair that with rate limits on repeated attempts.
Frequently asked questions
Does the CVV ever change?
No. The printed code stays the same for the life of the card. A new code arrives only with a replacement card or a reissued number.
Can a stolen card pass verification?
Yes, if the offender holds the full number, the expiry date, and the CVV and the issuer does not challenge the payment. That is why 3D Secure and address checks exist as separate layers.
Is it safe to give a CVV over the phone?
Only when you placed the call to a number you looked up yourself. Incoming calls that ask for the code are a common scam pattern.