Card Validation Software: Checks, Limits, Rules

What card validation software does

Card validation software checks a card number on two levels. Structural checks run offline: length, prefix, and the Luhn check digit. Account checks run online: the issuer approves or declines the transaction through a payment processor. Only the second level confirms that an account is open.

card check service

Luhn check digit

The final digit of a card number is a mod-10 checksum. ISO/IEC 7812 defines the numbering scheme. The Luhn formula catches any single mistyped digit and most swaps of two adjacent digits. It does not test whether the account exists.

more on this topic

Issuer identification number

The first six to eight digits are the issuer identification number, also called the BIN. The range identifies the issuer and the brand. Ranges get reassigned, so a BIN table needs updates. A stale table returns the wrong brand or the wrong card type.

Guide to Using a Card Verification API

Authorization

Validation that matters happens at authorization. The merchant sends the card number, the expiry date, the amount, and often CVV2 and a billing address. The issuer returns an approval code or a decline code. Decline codes cover fraud, insufficient funds, expired cards, and data entry errors. A decline is not proof of fraud. An approval is not proof of identity.

CVV2 and AVS

CVV2 is a three-digit value printed on the back of Visa, Mastercard, and Discover cards. American Express prints four digits on the front. The issuer compares the submitted value to its record. AVS compares the numeric part of the billing street address and the ZIP code. Both raise the cost of card-not-present fraud. Neither stops it.

What validation cannot do

Validation software cannot prove an account is open without an authorization request. It cannot verify that the person holding the card is the account holder. It cannot move funds. Results are probabilistic.

Rules for merchants

PCI DSS applies to any system that stores, processes, or transmits card numbers. Sensitive authentication data, including the CVV2, must not be stored after authorization. Tokenization replaces the card number with a reference value, so the merchant system never holds the account number. In the United States, 18 U.S.C. 1029 makes trafficking in card credentials a federal crime, with penalties up to 10 years for a first offense.

Where the software sits

Payment processors and gateways bundle these checks: Stripe, Adyen, Braintree, Worldpay, and bank-issued terminals. Open-source libraries handle the offline parts, and several JavaScript and Python packages implement the Luhn test and BIN lookup. The offline libraries are free. The online checks require a merchant account and cost a per-transaction fee.