How Authorize.net verifies a card
Authorize.net credit card verification runs two checks against the card issuer. The gateway sends the card code and the billing address inside the authorization request. The issuer returns one letter for the card code check and one letter for the address check. Authorize.net passes both letters to the merchant in the transaction response.
How to Use an Authorize.Net CVV Test Tool: A Guide for Online Purchases
Both checks travel in the same authorization message. No second API call is needed. The request fields are cardCode plus the billing fields billToAddress and billToZip.
Card code (CVV) checks
The card code is 3 digits for Visa, Mastercard, and Discover. It is 4 digits for American Express. The code is printed on the card and never appears on a receipt.
Authorize.Net Payment Card Check Guide
Authorize.net returns these card code result codes:
Authorize.Net Payment Card Verification Guide
- M: code matches
- N: code does not match
- P: not processed
- S: code should have been present but was not sent
- U: issuer cannot process the request
- X: no response from the issuer (American Express)
- blank: no code was sent in the request
Address Verification Service (AVS)
AVS compares the numeric parts of the billing address to the address on file with the issuer. Authorize.net supports AVS for issuers in the United States, Canada, and the United Kingdom. Issuers in other countries return no address data.
Common AVS codes:
- Y: street address and 5-digit ZIP match
- X: street address and 9-digit ZIP match
- A: street address matches, ZIP does not
- Z: 5-digit ZIP matches, street address does not
- W: 9-digit ZIP matches, street address does not
- N: street address and ZIP do not match
- U: issuer does not support AVS
- G: issuer outside the US does not support AVS
- R: system unavailable, retry the request
- S: AVS not supported
- E: not eligible for AVS
Rejection settings
Authorize.net does not reject a transaction because of a CVV or AVS mismatch by default. The merchant turns rejection on in the Merchant Interface. Options include reject on card code mismatch, reject on AVS mismatch, or reject on either. A separate rule can be set for each transaction type.
An approved transaction with an N code settles unless the merchant voids it before settlement.
Storage rules
PCI DSS Requirement 3.2 bans storage of sensitive authentication data after authorization. That data includes the card verification code. Authorize.net does not return the code in stored transaction records. A merchant who keeps the code in a database fails the requirement.
Test mode
Test mode returns preset codes. The sandbox uses test card numbers that produce fixed card code and AVS results. A test result shows how an integration handles each response. It does not show what a live issuer will return.