Short answer
A card verification pattern is the order in which a payment system checks a card before the issuer gets a say. Format checks come first (length, BIN range, Luhn checksum). Then the field matches: expiry, CVV or CVC, and billing address through AVS. Then a risk step-up such as 3-D Secure. Only after all of that does the issuer return an approve or decline. The order is what makes the pattern useful. A transaction that dies at the checksum never carried a valid number, while one that dies on a CVV mismatch reached the issuer and was told no.
Format and checksum checks
These run on the number alone, offline, in a few milliseconds:
- Length by brand, usually 13 to 19 digits.
- Issuer identification number (the leading digits) mapping to a bank and card product.
- Luhn check digit validation, which catches single-digit typos and most transpositions.
Nothing here proves a card exists. A number can pass every format test and belong to nobody.
Field verification
Once format passes, the gateway sends the transaction to the issuer with the card data and asks for verification on specific fields. CVV and CVC come back with a result code, typically match, no match, not processed, or unavailable. AVS returns the street and ZIP results separately, so you get outcomes like street match, ZIP fail. I treat a partial AVS result as normal rather than alarming. People move, keep an old billing address on file, or use a business address that does not match the statement.
Risk step-up
If the pattern reaches this stage with a good CVV and a clean AVS, many issuers still ask for a second factor. 3-D Secure pushes the cardholder to an app approval or a one-time code. A pass here shifts liability for fraud chargebacks from the merchant to the issuer, which is the actual reason merchants adopt it.
Reading the result
Declines carry reason codes, and the code tells you where in the pattern the transaction stopped. A CVV no-match is a distinct response from insufficient funds or do not honor. That distinction matters for support tickets and for retry logic. Retrying a CVV mismatch is pointless. Retrying a soft decline from a network timeout sometimes is not.
Common misconceptions
- CVV is not a password. It confirms the card is physically present, nothing more.
- Passing Luhn means the number is well formed, not valid.
- Some card types and some issuers do not support CVV or AVS checks at all, so the pattern shortens.
Compliant processors do not store the CVV after authorization, so no later check can use it again.