Card validation is a set of checks that confirm a card number is well formed, the account is open, and the issuer will approve a specific charge. The checks run in under 3 seconds and end with an approval code or a decline code.
Format checks at the point of entry
The first checks happen before any network call.
- Length: a primary account number (PAN) holds 13 to 19 digits.
- Luhn check: a mod 10 checksum. One mistyped digit fails the test.
- Issuer identification number: the first 6 to 8 digits map to the issuing bank and card brand.
- Expiry: the month and year must be current or later.
- Security code: 3 digits on Visa and Mastercard, 4 digits on American Express.
These checks reject typos and test strings. They do not prove the account exists.
Authorization request
- The merchant sends an ISO 8583 message to its acquirer with the PAN, amount, currency, and merchant category code.
- The acquirer routes the message to the card network.
- The network sends it to the issuing bank.
- The issuer returns a response code.
- The acquirer passes that code to the merchant.
A closed account, a lost card, or a credit limit below the charge amount stops the request at step 4.
Issuer-side checks
The issuer compares the address and postal code on file against the billing data in the request. This is Address Verification Service, or AVS. It returns a letter code such as Y for a match on street and ZIP, or N for no match. AVS covers the United States, Canada, and the United Kingdom. Issuers outside those markets may return a not-supported code.
The issuer also checks the card verification value. CVV1 sits in the magnetic stripe or chip. CVV2 is the printed code. A mismatch returns a decline. Three-D Secure adds a cardholder step, such as an app approval or a one-time code, and shifts liability for fraud to the issuer.
Fraud scoring runs in parallel. Models weigh transaction velocity, merchant history, device data, and geography. A high score can trigger a review or a block even when funds are available.
Common response codes
- 00: approved
- 05: do not honor
- 14: invalid card number
- 51: insufficient funds
- 54: expired card
- N7: CVV verification failed
After approval
An approval places a hold on the funds. The hold lasts 1 to 8 days for most card types. Clearing and settlement move the money between the issuer, network, acquirer, and merchant, often within 1 to 3 days. The cardholder can dispute the charge for up to 120 days under network rules.
What validation does not do
Validation confirms a card number and an available credit line. It does not confirm that the person at the keyboard holds the card. A charge can pass every format and AVS check and still be fraud. PCI DSS forbids storing the security code after authorization, so a merchant cannot re-run a CVV check on a later charge.