Card Assessment: How to Verify a Card the Legal Way

Answer first: card assessment is the work of confirming that a payment card is genuine, active, and authorized for the transaction in front of you. For most US merchants the best single option is a payment processor that runs fraud scoring inside the authorization request, because card checks, address verification, security code matching, and risk scoring all return in one response. The criteria that matter are authorization coverage, address verification and CVV match codes, 3-D Secure support, chargeback tooling, and the cost of screening each order.

card check

One boundary before anything else. This guide covers lawful assessment done by merchants, processors, and cardholders. Buying or selling card numbers, or testing cards you do not own, is access device fraud under US law and a common way people get robbed by other criminals. No section below helps with that.

read more

What a card assessment checks

A real assessment answers four questions in order.

card check

1. Format validity. Does the number pass the Luhn check and fit a known card range? This catches typos and nothing more.
2. Status. Does the issuer approve, decline, or refer the authorization? Only the issuer can confirm a card is open and funded.
3. Identity match. Do the billing address and security code match what the issuer has on file? These come back as AVS and CVV result codes.
4. Risk. Does the order fit the cardholder's normal behavior for device, geography, velocity, and order value?

Steps one through three are plumbing. Step four is where most fraud loss is either prevented or missed.

Option 1: Integrated processor risk engines

Stripe Radar, Adyen risk tools, Braintree, and Square bundle screening with processing.

• Pros: one integration, one contract, authorization and scoring in the same call, models trained on your own chargeback outcomes.
• Cons: less control over rule logic, scoring tuned to the processor's whole portfolio instead of your niche, caps on custom data.

Best for small and mid-size US merchants who want a working fraud layer this week and do not have a risk team.

Option 2: Standalone fraud and identity platforms

Sift, Kount, and Riskified sit in front of your processor.

• Pros: deep device fingerprinting, shared network signals across merchants, custom rules, case management for disputes.
• Cons: extra contract and integration work, monthly minimums, heavy for low volume, often billed per reviewed order.

Best for merchants with high order volume, digital goods, or a chargeback rate that already puts their processing account at risk.

Option 3: Rules, velocity limits, and manual review

Fixed thresholds you write yourself: cap orders per IP per hour, block mismatched country pairs, hold high-value orders for a human.

• Pros: cheap, transparent, quick to change when fraud shifts.
• Cons: brittle, easy for an attacker to probe, does not scale, and manual review is a staff cost.

Use this as a second layer on top of Option 1 or 2, never as your only control.

For cardholders: assessing your own card

You can run your own check without any third party.

• Open the issuer app and read pending authorizations, including small test charges you did not make.
• Scan statements line by line for merchants you do not recognize, especially recurring amounts.
• Turn on transaction alerts so a charge reaches you in minutes, not at statement close.
• Report unauthorized charges to the issuer, then file with the FTC's identity theft service and the FBI's Internet Crime Complaint Center if money was taken.

Card testing: the attack to design against

Card testing is when someone pushes a list of card numbers through your checkout to learn which ones still work. Watch for a spike in small-dollar orders, clusters of declines from one IP range, billing countries that do not match the shipping address, and repeated attempts against one account or one card. Controls that work: rate limits per IP and per card, a challenge on checkout, require AVS and CVV match before you ship, step up risky orders to 3-D Secure, and monitor your decline ratio so you notice the run while it is happening.

Checklist before you pick a provider

1. Confirm the platform returns AVS and CVV result codes, not just an approve or decline.
2. Check how rules are edited and whether changes take effect without a developer.
3. Ask how chargebacks are handled and who writes the rebuttal evidence.
4. Test the integration in sandbox mode with known decline scenarios.
5. Read the contract for per-screened-order fees and minimums.

Bottom line

If you process payments in the US, start with an integrated processor risk engine, add velocity rules, and step up to a standalone platform when volume or chargebacks justify it. If you hold a card, use your issuer's app and alerts, and treat any offer to buy, sell, or test card numbers as a crime and a scam in the same package.