Authorize.Net Card Check: A Merchant Buying Guide

The core answer: a card check on Authorize.Net is a verification request sent to the card issuer that confirms whether the account number, expiration date, billing address, and card code are valid. It does not have to move money, and in most setups it does not. If you are shopping for a gateway or a fraud-screening layer for your store, the deciding factor is not the brand name. It is whether the response you get back is detailed enough to act on and whether your setup keeps you inside PCI DSS rules.

Authorize.net Card Inspection: How Card Verification and Fraud Filters Work

What an Authorize.Net card check actually does

Authorize.Net is a payment gateway, not the bank that holds your merchant account. When you submit a verification request, the gateway passes it to the processor and then to the issuer. The issuer compares what you sent against what it has on file and returns response codes. Authorize.Net surfaces those codes in the transaction response, through the Address Verification Service (AVS) and the card code (CVV or CVC) check.

read more

A card check is not a guarantee. An issuer can return a full match and still decline the transaction later for insufficient funds, a closed account, or a fraud rule. Treat the response as one input in a risk decision, not as a green light.

authorize.net card test

What to look for before you commit to a setup

• Full response codes in the API payload, not just an approved or declined flag.
• Support for the Customer Information Manager (CIM) validation modes: none, testMode, and liveMode, so you can validate a stored profile without a sale.
• A sandbox that lets you reproduce every AVS and CVV outcome using test card numbers.
• Clear rules about what you may store after the check runs.
• Logging that keeps the request and the response codes for your dispute evidence.

Parameter bands worth knowing

AVS returns a single-letter code. The ones that matter most in a US store:

• Y: street address and five-digit ZIP both match.
• X: exact match, including the nine-digit ZIP.
• A: address matches, ZIP does not.
• Z: five-digit ZIP matches, address does not.
• N: neither matches.
• U: issuer cannot verify, often because the data is unavailable.
• G: non-US issuer, so AVS is out of scope.
• E or S: the issuer or the network does not support the check.

CVV returns its own code: M for match, N for no match, P for not processed, S for the code should have been on the card but was not sent, and U for unavailable. A mismatch on both AVS and CVV is the strongest fraud signal the gateway can hand you.

Pitfalls to avoid

1. Storing the card code. PCI DSS forbids retaining sensitive authentication data after authorization. You may keep the pass or fail result, not the three or four digit value.
2. Treating AVS as a global tool. It is a US, Canada, and UK feature in practice. International cards return G or U, and rejecting those orders outright will cost you legitimate sales.
3. Running a live authorization for a check the issuer will not honor. A zero or one-cent authorization followed by a void is common, but a voided authorization can still carry a fee, so confirm the terms with your merchant account provider.
4. Blocking on a single code. Build a rule that weighs AVS, CVV, order velocity, and shipping mismatch together.
5. Testing in production. Use the sandbox. Live test transactions touch real cardholders and can trigger chargebacks.

FAQ

Does a card check move money?

Not necessarily. A pure verification request authorizes nothing. If your provider requires an authorization, the amount is small and is then voided, and the hold can take several business days to drop off.

Can I run card checks on a stored profile?

Yes. CIM supports a validation mode of liveMode or testMode when you create or update a profile, which returns the AVS and CVV codes without a sale.

Why did my check return U or S?

U means the issuer could not supply the data. S means the card should have had a code but none was sent. Both point to a data problem on the issuer side or at the point of capture, not to confirmed fraud.

What should I do with a failed check?

Do not auto-approve. Route the order to manual review, request a second form of verification, or decline and ask for another payment method. Document what you saw, because that record is your evidence if a chargeback follows.