Card number authentication is the set of checks that confirm the card number entered at checkout belongs to the person presenting it and that the account behind it is open and in good standing. It runs in layers. No single layer proves much on its own, which is why issuers and processors stack them.
Card Number Check System: How Card Validation Actually Works
Checks that run before the authorization request
A lot happens between the keystroke and the network message. The gateway screens the number first, and a bad format usually dies right there.
Card Number Authentication Process: How It Works
- Luhn check. A checksum validates the digits. It catches typos and transposed numbers, nothing more. A number can pass Luhn and still be fake.
- BIN lookup. The first six to eight digits identify the issuing bank, the card brand, the card type, and often the country. Mismatches between the card's country and the shopper's IP or shipping address are a signal.
- Expiry validation. An expired date fails before anything reaches the issuer.
CVV is a separate secret, not part of the number
People conflate the two constantly. The CVV or CVV2 is a three or four digit code printed on the card that the issuer generates separately from the account number. It is meant to prove the physical card is in hand, though anyone who has copied the card has copied the code too. Under PCI DSS, merchants may not store the CVV after authorization under any circumstances. If a processor offers to keep it for you, that is a problem, not a feature.
Address Verification Service
AVS compares the numeric portion of the billing street address and the ZIP code against what the issuer has on file. It returns a letter code: full match, partial match, no match, or not supported. AVS is a US-centric tool and behaves poorly on international addresses. Treat a partial match as a risk signal to weigh, not an automatic decline.
3-D Secure and step-up authentication
This is the layer that actually authenticates a human. The merchant redirects or embeds a challenge, the issuer evaluates the session with its own risk engine, and the cardholder confirms with a password, a one-time code, or a biometric on their banking app. The result comes back as a cryptogram bound to that transaction. Two things matter for liability: a fully authenticated transaction generally shifts chargeback liability for fraud to the issuer, and a merchant that skips the challenge keeps the risk. Frictionless flows approve low-risk sessions with no prompt at all, so most shoppers never see a challenge.
Network tokens
Tokenization replaces the real number with a surrogate tied to a specific device or merchant. The token is useless if it leaks, and it can be scoped to a single merchant. Wallets and card-on-file programs lean on this heavily, and it quietly removes a lot of the exposure that number authentication was designed to cover.
What authentication does not do
It does not stop a fraudster who has full card data and a matching address. It does not stop friendly fraud, where a real cardholder disputes a charge they made. It does not replace velocity limits, device fingerprinting, or order review. Authorization only tells you the issuer will fund the charge right now. Chargebacks arrive weeks later, and the cost of a lost dispute plus fees usually dwarfs the order.
The practical takeaway
Ask for the CVV, run AVS, and let 3-D Secure handle the riskier sessions. Store nothing beyond what PCI DSS allows, and never keep the CVV. If a checkout flow collects a card number without any of these checks, the merchant is absorbing risk that someone else already priced in.