Adyen Card Verification Tool: CVV, AVS and BIN Checks Explained

The Adyen card verification tool is the set of checks Adyen runs on a card during authorization or a zero-value request: CVV/CVC match, address verification (AVS), BIN and card type lookup, and 3D Secure. Each check returns its own result code in the API response, so a merchant can accept, review, or decline an order before shipping. The checks tell you whether the card data is consistent with the issuer's records, not whether the person paying owns the card.

read more

What does the Adyen card verification tool check?

Adyen returns four separate signals in a single payment response. No single signal settles the question of who is holding the card.

Adyen Card Test Utility Guide

• CVV/CVC match. The three-digit code on the back of a Visa or Mastercard, or the four-digit code on the front of an American Express card, is compared against the issuer's record.
• AVS. The numeric portion of the billing street address and the postal code are matched against what the issuer holds on file.
• BIN lookup. The first six to eight digits resolve to the issuing bank, the card brand, the funding type (credit, debit, prepaid), and the country of issue.
• Zero-value authorization. A request for 0.00 in the local currency, where the market allows it, validates the card without moving money and returns the issuer's response.

How is the CVV result reported?

Adyen returns the CVV outcome in additionalData.cvcResult, with the raw issuer value in cvcResultRaw. The codes follow a numbered scheme that covers matched, not matched, not checked, and missing. A "not checked" result appears on some card brands and in some regions, so treat it as unknown rather than as a pass.

adyen card check tool

How is the AVS result reported?

The address outcome arrives in additionalData.avsResult, again with a raw counterpart. AVS support differs by country: US, Canadian, and UK issuers return useful data, while many issuers outside those markets return nothing at all. A blank AVS field on a cross-border order means the check could not run, not that the address is wrong.

Adyen Card Check Tool Buying Guide

What does the BIN lookup add?

A BIN response returns the card brand, the issuing bank, the card type, and whether the card is credit, debit, or prepaid. Prepaid and gift cards carry higher risk in most risk models because they have no account history behind them. The BIN also shows the country of issue, which you can compare against the shopper's IP country and shipping country.

How do you run a card check in the Adyen API?

1. Send a /payments request with encrypted card data and a 0.00 amount if your market supports zero-value authorization.
2. Read resultCode and refusalReason for the authorization outcome.
3. Read the additionalData object for cvcResult, avsResult, and BIN details.
4. Route the order by rule: accept, hold for review, or decline.

Zero-value authorization is not offered in every market. Where an issuer rejects a 0.00 amount, a one-unit authorization followed by a void is the common workaround, and it costs an authorization fee.

What do the CVV and AVS result codes mean?

Both fields return short numeric strings, and the same number means different things in each field. Check the current mapping in Adyen's documentation before you code rules against the values.

• CVV matched. The code supplied matches the issuer's record. This is the strongest of the four signals.
• CVV not matched. The code is wrong. Decline or hold unless you have a strong reason to accept.
• CVV not checked or missing. The issuer did not run the check, or the card data arrived without a code. Score it as neutral.
• AVS full match. Street number and postal code both match.
• AVS partial match. One of the two matches. Common on apartment addresses and on orders shipped to a work address.
• AVS no match or no data. Neither field matches, or the issuer returned nothing.

How do you test card verification in the Adyen sandbox?

The test environment lets you trigger each result on purpose, which matters because you cannot force a real issuer to return a mismatch. Adyen publishes test card numbers tied to specific outcomes.

• Use the listed test cards to produce a CVV match, a CVV mismatch, and a "not checked" response.
• Use the AVS test addresses to produce full match, partial match, and no match.
• Run the 3D Secure test flows for both the authenticated and the failed challenge.
• Log the full additionalData object during testing so your rules match the real field names.

What the Adyen card verification tool does not do

The tool confirms that the card data is internally consistent. It does not confirm intent.

• It cannot prove the buyer owns the card. A stolen card number and CVV usually pass both checks.
• It cannot be stored. PCI DSS forbids keeping the CVV, and any sensitive authentication data, after authorization completes. Store the result code, never the code itself.
• It does not replace 3D Secure. A CVV match is a data check; 3D Secure is cardholder authentication. Only the second one shifts fraud liability.
• It does not stop chargebacks. A clean verification result is not evidence in a dispute. Order tracking, delivery confirmation, and customer contact records are.

How should a merchant combine the results?

Weight the signals instead of treating each one as a pass or fail. A CVV match with a full AVS match on a card from the shopper's own country is a low-risk order. A CVV mismatch on a prepaid card shipped to a different country is a decline.

• Decline on a CVV mismatch unless the order value is small and the account history is clean.
• Hold for review when AVS fails but CVV matches, and the shipping address differs from the billing country.
• Accept a "not checked" CVV when 3D Secure authenticated the shopper, since liability moved to the issuer at that point.
• Log every result code next to the order so you can measure which combination predicts chargebacks in your own data.

Frequently asked questions

Does a CVV match mean the payment is safe?

No. Card testing attacks use valid number and CVV pairs taken from a breach, so the check passes and the order still ends in a chargeback. Velocity limits and 3D Secure cover the gap.

Does Adyen charge for a zero-value authorization?

Pricing depends on your contract and the market. Many issuers treat a 0.00 request as a normal authorization for fee purposes, so confirm the cost before you build a flow that runs one on every order.

Can I re-run a verification on the same card later?

Yes, but you need the card data again. Since the CVV cannot be stored, a repeat check requires the shopper to re-enter the card, or a stored credential token from a prior transaction.