What a card authentication tool does
A card authentication tool checks that a payment card is valid and that the person using it is authorized to use it. The tool sits between the checkout page and the card issuer. It runs checks on the card number, the cardholder data, and the device. It returns one of three results: approve, decline, or refer for more verification.
Main authentication methods
3-D Secure
3-D Secure adds an issuer check during online checkout. The cardholder is sent to the issuer or shown an in-app challenge. The issuer returns an authentication value with the authorization. EMV 3-D Secure is the current version. It supports risk-based challenges, so low-risk transactions pass without a password.
Understanding Card Verification Tools: A Comprehensive Guide
Address Verification Service (AVS)
AVS compares the billing address and postal code at checkout with the address on file at the issuer. The processor returns a single-letter code. A full match is more likely to be approved. A mismatch does not always decline the transaction. Merchants set their own rules for each code.
Card Validity Checker: What It Checks and What It Cannot
CVV and CVC checks
The three-digit code on the back of Visa, Mastercard, and Discover cards, and the four-digit code on the front of American Express cards, is a verification value. The issuer checks it during authorization. The code is not stored with the card number. PCI DSS rules prohibit storing it after authorization.
Card Authenticity Checker Guide
Chip and contactless
EMV chips generate a unique cryptogram for each transaction. A copied chip value fails on a second use. Contactless cards use the same cryptogram process over NFC.
Tokenization
Tokenization replaces the card number with a token. The token works at one merchant or one device. A stolen token cannot be used at another merchant.
Risk scoring
Processors score each transaction on device data, IP address, transaction history, and velocity. A high score triggers a step-up challenge or a decline.
What these tools do not do
Authentication reduces fraud. It does not remove it. Card-not-present fraud still occurs when a cardholder's data is used with a valid authentication value. Chargeback liability rules decide which party absorbs the loss. Liability shifts to the issuer for transactions that complete full 3-D Secure authentication.
Where the checks happen
- At the payment gateway, before the authorization request is sent.
- At the issuer, during authorization.
- At the acquirer, after settlement.
Each layer sees different data. A gateway sees the device and the address. The issuer sees the account history and the verification value result.