A Braintree card check is the set of verifications Braintree runs when a payment card is submitted for authorization. It combines CVV verification, address verification (AVS), and the card issuer's approval decision. Each part returns its own response code, and the merchant's rule settings decide which results kill the sale.
What Happens During a Braintree Card Check?
Braintree sends three pieces of data to the issuer in a single authorization request: the card number, the security code, and the billing address. The issuer answers with a CVV code, an AVS code, and an approval or a decline.
All three land in the transaction response object and in the Braintree Control Panel. Developers read them in the API; support teams read them in the dashboard.
CVV verification
The CVV check compares the 3-digit code on the back of the card (4 digits for American Express) with the value the issuer holds on file. A match means the person submitting the card has the plastic in hand or knows its code.
Braintree Card Authentication Process Guide
PCI rules forbid storing CVV data after authorization, so the check happens once and the code is discarded.
Address Verification (AVS)
AVS compares the numeric part of the billing street address and the ZIP code against the issuer's records. The check works in the US, Canada, and the UK, where banks support it. Many international issuers return no AVS data at all.
Authorization
Authorization is the issuer's final yes or no. A CVV match plus an AVS match still declines if the account is closed, over limit, or flagged for fraud. The authorized amount sits as a hold on the card until the merchant captures or voids it.
Braintree CVV Response Codes
Braintree returns one letter for the CVV check.
- M - CVV matches the issuer's record.
- N - CVV does not match.
- P - CVV was not processed by the issuer.
- S - The card should have carried a CVV but the issuer returned none.
- U - The issuer cannot process the check, often a technical failure or an unsupported card type.
An empty CVV field means no check ran, which happens when the merchant does not collect or require the code.
Braintree AVS Response Codes
AVS returns a letter that maps to how much of the address matched. US merchants see these most often:
- Y - Street address and 5-digit ZIP match.
- X - Street address and 9-digit ZIP match.
- Z - 5-digit ZIP matches, street address does not.
- A - Street address matches, ZIP does not.
- N - Neither the street address nor the ZIP matches.
- W - 9-digit ZIP matches, street address does not.
- I - The issuer cannot verify the address.
- U - Address data is unavailable.
- R - The system is down, retry the check.
- S - AVS is not supported for this card type.
International cards return codes such as M, D, B, and C, where fewer address fields get compared. A code of I or U is not a fraud signal on its own.
Why a Braintree Card Check Fails
Declines come from the issuer, from Braintree's gateway, or from the merchant's own rules.
- Wrong or missing CVV.
- A billing address that does not match the issuer record.
- Expired card or closed account.
- Insufficient funds or credit limit reached.
- Merchant rule set to reject any AVS mismatch or any CVV no-match.
- Velocity limits or fraud filters tripped by the same card, IP, or email.
Issuer declines carry processor response codes, such as 2000 for a generic do-not-honor and 2010 when the issuer rejects the CVV. Gateway declines use a different code set, which tells you whether to retry or ask the customer for new card details.
How Merchants Set Card Check Rules in Braintree
CVV and AVS checks are optional. The Control Panel has a Fraud Tools area with settings for both.
- CVV - require, do not require, or ignore.
- AVS - require an exact match, allow a partial match, or ignore the result.
Most US merchants require CVV and accept a ZIP match without a street match. That balance cuts fraud without losing customers who moved last month.
How to Stop Card Testing on Braintree
Card testing is a burst of small authorizations run against many card numbers to find accounts that still work. The pattern shows up as a spike in declines from one IP range, or as hundreds of cards hitting one customer account.
- Turn on CVV and AVS rules so mismatched data fails at the gateway.
- Use Braintree's Advanced Fraud Tools to score each request before it reaches the issuer.
- Set velocity rules by card, IP, email, and device.
- Reject requests that leave the security code field blank.
- Watch for repeat $0 or $1 authorizations, a common test pattern.
Each failed test costs a card check and, in many cases, an interchange fee. Braintree bills per authorization, so abuse hits the merchant's statement fast.
FAQ
Does Braintree run a CVV check by default?
No. CVV verification runs only when the merchant turns on the CVV rule in Fraud Tools and collects the code at checkout. Leave the rule off and the response field comes back empty.
Can a $0 authorization verify a card?
Braintree supports card verification for Visa and Mastercard in the US through a verification transaction, which places a small or zero-amount hold. The response confirms the card number, expiry, and CVV status without a real charge.
Does a CVV match prove the card is valid?
No. A CVV match means the security code is correct. It says nothing about available funds, account status, or whether the person using the card has permission to use it.