Card Verification Test: How Merchants Verify a Card

A card verification test is a zero-amount or small-amount authorization that confirms a payment card is valid and that the cardholder's details match before a merchant stores the card or starts recurring billing. It checks the card number, expiration date, security code, and billing address against the issuer's records without transferring real money to the merchant.

What a card verification test actually checks

A verification test is not one check. It is a bundle of signals the issuer and the payment network return to the merchant.

• Card number and expiration date. The issuer confirms the account exists and is open, and that the expiration date on file matches.
• Security code. The three-digit code on the back of most cards, or the four-digit code on the front of American Express cards, is compared to the value the issuer holds. This is the check people usually mean when they say CVV verification.
• Billing address. The Address Verification Service compares the street number and postal code the customer typed with what the issuer has on file.
• Account standing. The issuer may flag a card as lost, stolen, frozen, or over its limit.

How merchants run a card verification test

Most processors expose verification as a standard authorization call with a defined amount. Three patterns cover nearly every case.

1. Zero-dollar authorization. The merchant sends an authorization request for $0.00. Nothing is held against the cardholder's available credit. Some issuers decline zero-amount requests, so this is not universal.
2. Small-amount authorization. The merchant requests a nominal amount, commonly $1 or less, then voids or reverses it. The hold usually clears within a few business days.
3. Card-on-file verification. For subscriptions and trials, the merchant verifies the card at signup and stores a token, not the card number, for later charges.

Verification test vs. full authorization

A verification test answers one question: is this card usable and does the data match? An authorization answers a second question: does this cardholder have funds for this specific purchase? The two can happen in the same call, but they are separate decisions. A card can pass verification and still be declined for the purchase amount, and a card can authorize a charge while failing the security code or address check.

Reading the response codes

• CVV match. The security code is correct.
• CVV no match. The code is wrong, which often points to a typo or a mistyped digit.
• CVV not processed. The issuer does not support the check or the merchant did not send the data.
• AVS full match. Street number and postal code both match.
• AVS partial match. One element matches, which is common with apartment numbers and international addresses.
• AVS unavailable. The issuer cannot perform the check, often outside the United States.

When a verification test makes sense

• Setting up a subscription or free trial that converts to a paid plan.
• Saving a card for one-click checkout or a future invoice.
• Accepting a high-value or unusual order from a new customer.
• Replacing an expired card on an existing account.

Compliance boundaries you cannot skip

A verification test is a tool for checking cards that customers voluntarily give you. Running tests against cards you do not own, or against card numbers you obtained somewhere else, is card testing fraud and can violate payment network rules and federal law. Merchants should also know that PCI DSS prohibits storing the security code after an authorization, in any form, so the code can only be used in the moment it is collected.

Common mistakes

• Treating a passed verification as proof the customer is the cardholder. It is not.
• Leaving a small-amount hold in place instead of voiding it, which frustrates customers.
• Blocking every partial AVS match, which rejects legitimate international buyers.
• Storing the CVV to avoid re-collecting it later. Never do this.

The short version: a card verification test is a cheap, low-risk way to confirm a card is real before you commit to a billing relationship. Keep it tied to cards your customers give you, void the hold, and let the response codes guide your risk rules.