Braintree's card examination stack is the top pick for most US merchants because a single authorization call returns three checks at once: CVV verification, AVS matching, and 3D Secure authentication. The criteria used here are accuracy, the cost of a false decline, and the liability each check shifts back to the issuer. One rule frames everything below: card data must come from the cardholder. Buying, selling, or passing along card numbers is payment fraud, and no gateway setting makes it legal.

Braintree Test Card: Sandbox Testing Guide

What Braintree examines on every authorization

When a card is submitted through Braintree, the gateway passes the request to the processor and returns a response object with the authorization result, a CVV response code, an AVS response code, and, when 3D Secure is enabled, an authentication status. Merchants set rules in the control panel that map those codes to actions: approve, review in the fraud queue, or decline. The order matters, because a card that fails CVV and AVS together is a much stronger signal than either failure alone.

more on this topic

Legitimate reasons for a mismatch exist and are common. A customer may have moved, typed a ZIP code from memory, or used a card issued in another country. Braintree's own guidance treats these codes as inputs to a risk decision, not as proof of anything by themselves.

braintree card test

CVV verification

The CVV check compares the three or four digit security code against the value the issuer has on file. It is the only check that proves the person submitting the card physically holds it, which is why it carries weight in a fraud review.

Braintree Card Authentication Process Guide

Pros

  • Catches mistyped or guessed security codes before capture.
  • Works on nearly all US consumer cards, including debit.
  • Response codes (M, N, U, S, P) let you separate a wrong code from an unsupported one.

Cons

  • Some card types and regions do not support CVV, so response code U is common and not a fraud signal.
  • Recurring and subscription charges after the first authorization cannot be re-checked against the code.
  • PCI DSS forbids storing the CVV after authorization, so you can never re-verify it later.

Recommendation: decline on response code N for one-off digital goods, and route N to manual review for physical shipments where a reship is cheap.

AVS (address verification)

AVS compares the billing street number and ZIP code to what the issuer has on file and returns a single character code. It is a strong signal for card-not-present orders but a weak one for international cards.

Pros

  • Reliable on domestic US cards, where issuers maintain current address data.
  • Reduces chargeback exposure on high-ticket physical orders.
  • Free with most US processor agreements, so there is no per-check cost.

Cons

  • Partial matches are noisy; a street-number match with a ZIP mismatch is rarely decisive.
  • Many international issuers return no data at all, which looks identical to a bad match.
  • Strict AVS rules cut off gift orders and customers who recently moved.

Recommendation: require a full match for orders above your average order value, and accept partial matches below it while flagging the account.

3D Secure authentication

EMV 3D Secure adds an issuer-side authentication step, usually a push notification or one-time code in the cardholder's banking app. A successful authentication shifts fraud liability for the transaction to the issuer.

Pros

  • Liability shift on authenticated transactions, which is the main reason to adopt it.
  • Frictionless flow for low-risk sessions, so most customers see no extra step.
  • Satisfies Strong Customer Authentication rules for sales into the EU and UK.

Cons

  • Challenges add drop-off, and some cardholders abandon at the bank screen.
  • Setup and testing take real engineering time, and issuer support varies.
  • It does not replace CVV or AVS rules; it sits alongside them.

Recommendation: enable 3D Secure on cross-border orders and new accounts, and keep it off for returning domestic customers with clean history.

Fraud tooling and velocity rules

Braintree pairs the card checks with rules that look at behavior rather than the card itself: order velocity per email, IP geolocation mismatch, repeated failed attempts, and device fingerprint reuse. A card that passes CVV and AVS can still be declined here, which is the point. Rules catch patterns that a single transaction never shows.

Recommendation: start with a review queue instead of hard declines, watch the queue for two weeks, then convert the rules that consistently catch bad orders into automatic declines.

Which configuration fits your business

  1. Digital goods, instant delivery: strict CVV, strict AVS, 3D Secure on every new customer. The delivery is irreversible, so a false decline costs less than a chargeback.
  2. Physical goods, US only: strict CVV, moderate AVS, 3D Secure on orders above your average order value.
  3. Subscriptions: strict checks on the first payment only, plus velocity rules, since later charges cannot be re-verified.
  4. Cross-border sellers: treat missing AVS as neutral, lean on 3D Secure and velocity, and never decline on a code the issuer does not populate.

Tune the rules against your own approval and chargeback data before you tighten them. Every threshold you set trades fraud loss against lost sales, and only your numbers tell you where that line belongs.