Payment card verification is the set of checks a merchant runs between the moment you hit pay and the moment the bank approves the charge. It stacks several signals: the card number and expiry, the CVV printed on the card, the billing address (AVS), and often a challenge from the issuing bank through 3-D Secure. No single check proves the person typing is the cardholder. Each one closes a different gap.
The three checks you will meet at checkout
CVV and CVC
The three digit code on the back of a Visa or Mastercard, or the four digit code on the front of an Amex, is a check that the buyer has the physical card in hand. It is not printed on receipts and is not in the magnetic stripe or chip data. According to PCI rules, merchants may send the CVV for authorization but must never store it afterward, in any form. That single rule is why a CVV box exists on a checkout page but not in a merchant's database.
Address Verification Service
AVS compares the numeric part of the billing street address and the ZIP code you typed against what the issuer has on file. It returns a letter code, not a yes or no. A full match is good. A ZIP-only match is common when a customer moved and the issuer has an old address. Cross-border orders often return partial or unavailable results because not every market supports AVS. Merchants should read the code, not treat it as a pass or fail switch.
3-D Secure and bank challenges
3-D Secure pushes verification to the issuer. The cardholder sees a prompt from their bank, sometimes a password, sometimes a one-time code, sometimes nothing at all if the bank's risk engine is satisfied. The merchant gets an authentication result attached to the authorization. Liability for certain fraud chargebacks can shift to the issuer when authentication succeeds, which is the main reason merchants enable it on higher risk orders.
Why one check passes while another fails
The checks answer different questions. CVV answers whether someone has the card data. AVS answers whether they know the billing address. 3-D Secure answers whether the issuer recognizes the device or session. A stolen card number with a matching CVV will still trip AVS if the buyer does not know the address. A legitimate gift order will fail AVS because the shipping address differs. This is why a merchant that declines on any single mismatch loses good sales.
Reading a decline
- Do not honor is a general issuer block. The reason may be funds, risk score, or a travel pattern.
- CVV mismatch means the code sent does not match the issuer's record.
- AVS mismatch is usually a billing address difference, not fraud.
- Expired card is self-explanatory, but reissued cards with the same number are a common source.
- Authentication required means the issuer wants the cardholder to complete 3-D Secure before the charge proceeds.
If your own card fails verification
Check the billing address on file with your bank, not the address you want the order shipped to. Those are often different and AVS only reads the billing side. If you recently moved, update the address with the issuer before retrying. A CVV failure on a card you hold usually means a typo or a worn print, so read the digits carefully. Repeated failures can trigger a temporary block even when nothing is wrong.
What merchants should hold on to
Keep the authorization response, the AVS result code, the CVV result code, and the 3-D Secure authentication value for the period your processor and PCI obligations require. Do not store the CVV itself, the full track data, or the PIN block. Those are sensitive authentication data and PCI DSS prohibits retaining them after authorization, even encrypted. If you need to support repeat billing or disputes, the authorization record and the authentication result give you what you need without holding anything you are not allowed to keep.
Verification is a filter, not a guarantee. It raises the cost of fraud and lowers chargebacks, but a card that clears every check can still be disputed later. Treat the results as evidence to weigh alongside order history, velocity, and delivery risk.