What a card verification procedure is
A card verification procedure is the set of checks a merchant and its payment processor run to confirm that a card is valid, that the person using it is authorized to use it, and that the transaction is likely to be paid. In most online checkouts the procedure combines the card security code, the billing address, issuer authentication, and network-level risk scoring into a single decision.
The goal is not to collect more data than needed. It is to match a few signals against what the card issuer already knows, then approve, decline, or ask for a stronger check.
Card Verification Checklist: A Comprehensive Guide
The checks that usually run
- Card security code (CVV, CVC, or CVV2), the short code printed on the card.
- Address Verification System (AVS), which compares the billing address at checkout with the address on file.
- Issuer authentication, such as EMV 3-D Secure, which asks the cardholder to confirm the payment with their bank.
- Tokenization and network checks, where the card number is replaced by a token and screened against issuer and network data.
- Velocity and behavior checks, which look at order patterns, device signals, and shipping details.
Card security code
The security code is printed on the card but is not stored in the magnetic stripe or the chip. Because of that, asking for it is a way to check that the person has the physical card in hand. Under the PCI Data Security Standard, merchants are not allowed to keep the code after a transaction is authorized, so it is used once and then discarded.
Address Verification System
AVS sends the numeric part of the billing address and the postal code to the issuer, which returns a match, partial match, or no match. A mismatch does not automatically mean fraud. It often means a recent move, a typo, or a cardholder using a work address, so most processors treat the result as one factor among several rather than a final verdict.
Issuer authentication
In many markets, online payments trigger an authentication step where the cardholder confirms the purchase with their bank, often through an app or a one-time code. This shifts part of the liability for certain fraud types from the merchant to the issuer. Authentication is why a checkout may pause and redirect rather than approve right away.
What happens when verification fails
A failed check usually produces one of three outcomes: the transaction is declined, it is held for manual review, or the customer is asked to complete an extra step. Repeated failures on the same card or device can lead a processor to block the attempt entirely. Merchants generally see a response code rather than a detailed reason, because issuers limit how much information they share.
Why the procedure varies
Not every merchant runs every check. Card-present terminals may rely on the chip and PIN or signature. Small online shops may only request the security code and postal code. Larger merchants with fraud teams often combine AVS, authentication, device fingerprinting, and machine learning models. Regional rules, card network requirements, and the merchant's own risk tolerance all shape the final set of steps.
If a legitimate card is declined
- Re-enter the billing address exactly as the issuer has it on file.
- Check that the card number, expiration date, and security code match the card.
- Complete any authentication prompt from the bank instead of closing the window.
- Contact the issuer, since a fraud alert or a low available balance can block a charge.
Understanding the procedure helps cardholders and merchants tell an ordinary mismatch apart from a real problem, and it explains why a payment that looks fine on one site can be declined on another.