Adyen Card Validation Guide for Merchants

Scope: this guide is for merchants validating their own card payments. It does not address reselling or trading card data.

read more

The strongest setup for Adyen card validation is a layered one: card-number and expiry checks at the point of entry, CVV verification and AVS on the authorization request, and 3D Secure authentication where your risk profile or regional rules require it. The criteria that matter are coverage, false-decline risk, PCI scope, and how well you can test the flow before go-live.

adyen card test tool

What Adyen validates on a card payment

Adyen runs format and expiry checks before the request leaves your checkout, then passes CVV, AVS, and optional 3D Secure data to the issuer. The authorization response carries result codes for CVV and AVS plus a refusal reason when the payment fails. Adyen's risk engine can add velocity, device, and shopper-history rules on top.

adyen card check

• Card number: length, BIN range, Luhn check
• Expiry: month and year present and in the future
• CVV/CVC: checked with the issuer, result returned but value never stored
• AVS: street number and ZIP matched against issuer records in the US, Canada, and UK
• 3D Secure: shopper authentication with the issuer

CVV verification

• Pros: catches mistyped or guessed card data at authorization; low friction with no redirect; result codes let you tune risk rules
• Cons: not available for every card type or region; issuers may return "not checked"; does not prove the shopper is the cardholder

Use case: every card-not-present checkout as a baseline check alongside AVS.

adyen card test tool

AVS checks

• Pros: strong signal in the US, Canada, and UK; cheap and fast because it rides on the authorization; useful for flagging high-risk orders without blocking all foreign cards
• Cons: address formats vary and false mismatches are common; limited or unavailable in many markets; depends on accurate billing address collection

Use case: merchants shipping physical goods in the US, where a billing ZIP mismatch is a useful manual-review trigger.

3D Secure

• Pros: can shift chargeback liability for eligible transactions; satisfies PSD2 strong customer authentication in the EU and UK; supports a frictionless flow for low-risk shoppers
• Cons: adds a redirect or SDK step that can reduce conversion; authentication can fail for reasons outside your control; implementation and testing take longer

Use case: EU and UK merchants with SCA obligations, or any merchant with high fraud rates on digital goods.

Testing before go-live

Adyen's test environment uses test card numbers that trigger specific outcomes, so you can exercise CVV mismatch, AVS mismatch, expired card, and 3DS challenge flows without real money. Log the refusal reason and result codes, then confirm your order management handles each path: retry, ask for corrected data, or block.

Common validation failures

1. Expired or malformed expiry date
2. CVV mismatch from a mistyped code
3. AVS mismatch from a billing address that differs from the issuer record
4. 3DS authentication abandoned or failed
5. Issuer decline unrelated to validation, such as insufficient funds or a closed account

What to log and what never to store

Store the authorization result, refusal reason, CVV result code, AVS result code, and 3D Secure outcome. Never store the CVV/CVC value itself; PCI DSS prohibits retaining it after authorization. Keep card data out of logs and error messages, and keep test data inside the test environment.