Authorize.net Card Validation: AVS, CVV, and Auth-Only Checks

Authorize.net card validation is the gateway's check that a card number, expiration date, security code, and billing address are well formed and match the records the card issuer holds. It runs a format test on the number, submits an authorization or a $0.00 auth-only request, and returns AVS and CVV response codes alongside the transaction result. Validation confirms the data is valid and the account is recognized by the issuer, not that the person paying is the rightful cardholder.

authorize.net card verification

What does Authorize.net check during a validation request?

• Card number: length, BIN range, and the Luhn checksum are checked before anything reaches the issuer.
• Expiration date: must be a future date in MMYY or YYYY-MM format.
• Billing address: street number and ZIP are compared with issuer records through AVS.
• Card code: the 3 or 4 digit CVV, CVC, or CID is passed to the issuer for a match check.
• Duplicate window: identical repeat transactions inside a short window are flagged by the duplicate transaction detector.

How does the Authorize.net API handle validation?

Validation happens inside the createTransactionRequest call. The creditCard object carries the card number and expiration date, cardCode carries the CVV, and the billTo object supplies the address data used for AVS.

related article

An authOnly transaction type with a zero or one cent amount gives merchants a standalone verification without capturing funds. Authorize.net returns the AVS and CVV result codes in the same response as the transaction status.

Authorize.Net Card Check: How It Works and Why It Matters

Can you validate a card without charging it?

Yes. An auth-only transaction for $0.00 or $0.01 places a temporary hold or no hold at all, then is voided or left to expire. Card brands set the minimum, so some accounts must use $0.01. The hold drops off on the issuer's timeline, often within a few business days.

What are the AVS and CVV response codes?

Authorize.net returns single letter codes for each check.

• AVS: Y means street and ZIP match, A means street matches and ZIP does not, Z means ZIP matches and street does not, N means neither matches, U means the issuer does not support AVS, and E means an error occurred.
• CVV: M means match, N means no match, P means not processed, S means the code should have been present but was not sent, U means the issuer could not process it, and X means the issuer did not respond.

How do you test card validation in the sandbox?

The sandbox account at apitest.authorize.net accepts documented test card numbers, such as 4111111111111111 for Visa, with any future expiration date. Card codes like 900 return a match while codes like 901 return a failure, which lets developers exercise both paths. Sandbox results never reach a live issuer network.

What happens when validation fails?

The gateway returns a response code and a reason text. Code 1 is approved, 2 is declined, 3 is an error, and 4 is held for review. A CVV or AVS mismatch does not always block the sale, but it usually raises interchange cost and shifts chargeback liability toward the merchant.

Does card validation stop fraud?

No, validation only confirms the data matches issuer records. It cannot show whether the buyer has permission to use the card or whether funds are available until an authorization succeeds. Merchants layer it with velocity limits, device fingerprinting, and 3D Secure to lower risk. PCI DSS also prohibits storing the CVV once an authorization completes.