What is card number verification?
Card number verification is the process of confirming that a payment card number is structurally valid and belongs to an open account before a transaction is approved. It combines a format check on the digits, an issuer lookup through the BIN, and a real-time authorization request to the cardholder's bank. The result is a simple yes or no: should this charge proceed?
Verification is not the same as payment. It proves the number is well formed and the account is live, but it does not move money until the charge is captured and settled.
Card Number Authentication Process: How It Works
What checks happen during card number verification?
- Length and prefix check. Each network uses a fixed range of digits: 16 for Visa and Mastercard, 15 for American Express, 14 to 19 for Discover and others.
- Luhn checksum. A mod-10 arithmetic test catches typos and transposed digits before a request ever reaches the issuer.
- BIN lookup. The first six to eight digits identify the issuing bank, the country, and whether the card is credit or debit.
- Expiration and CVV match. The gateway confirms the expiry date is current and the security code matches what the issuer holds.
- Authorization. The issuer checks balance, fraud rules, and card status, then returns an approval or a decline code.
How does the Luhn check work?
The Luhn algorithm doubles every second digit from the right, subtracts 9 from any result above 9, and sums all the digits. If the total is divisible by 10, the number passes.
A Luhn pass only means the digits are consistent. It says nothing about whether the account exists, so a valid checksum is a formatting result, not proof of a live card.
card number verification method
What is a BIN and why does it matter?
The bank identification number is the leading portion of every card number, assigned under ISO/IEC 7812. It tells a merchant which network to route the request to and which bank will approve it.
BIN data also drives risk decisions. A merchant can flag a card issued in one country and used in another, or a prepaid card used on a high-value order, before submitting the charge.
What is the CVV and why is it verified?
The CVV or CVC is a three or four digit code that is not stored on the magnetic stripe or chip. It proves the person entering the number has physical access to the card.
PCI DSS forbids storing the CVV after authorization, even in encrypted form. Any system that keeps it is out of compliance and a target for attackers.
Verification vs. authorization vs. authentication
Verification checks the number's structure and metadata. Authorization asks the issuer to approve a specific amount. Authentication, such as 3-D Secure, confirms the cardholder's identity in the moment.
Strong programs run all three. Skipping authentication shifts chargeback risk onto the merchant.
What does a failed verification mean?
A failed Luhn check or bad length means the number was typed wrong or does not exist. A decline from the issuer is different: the digits were fine, but the bank refused the charge.
Decline codes separate the two. Do not retry a hard decline repeatedly, because repeated attempts raise fraud scores on the account and the gateway.
Is buying or selling card numbers legal?
No. Trafficking in payment card numbers is access device fraud under 18 U.S.C. 1029 in the United States and carries felony penalties. Card data traded outside the issuing bank has no legitimate verification path.
Legitimate card verification happens only inside a PCI DSS compliant payment flow, between a merchant, a gateway, and the issuer that owns the account.