Card Validation Explained

The layers of card validation

Validation is layered, and each layer answers a different question. Structural validation asks whether the number is well formed. Issuer-facing validation asks whether the account exists and the security code matches. Balance validation asks whether there are funds.

• Structural validation checks format and checksum
• Issuer validation checks the account, code and validity window
• Balance validation checks usable funds
• Response codes come from the issuer
• The layers should run in order

Structural validation

Structural validation is free, instant and needs no network access. The PAN must have the right length for its network, and it must pass the Luhn checksum. The security code must have the length the brand expects and the expiry must be inside its validity window. Most malformed input is caught here.

• Check length against the network's rules
• Compute and verify the Luhn check digit
• Verify security code length for the brand
• Confirm the expiry is in the future
• Normalise separators before checking

Issuer-facing validation

Issuer-facing validation is a real authorisation request. It confirms the account exists, that the security code matches the issuer record, that the card is not blocked and that the card level and country are permitted. The response code is the meaningful output, and it distinguishes an approval from a soft decline and a hard decline.

• An approval means the issuer authorised the test
• A soft decline may be a temporary block or a velocity limit
• A hard decline usually means blocked, expired or closed
• Never store the response code without its timestamp
• Test parameters change the outcome

Balance validation

Balance validation reports a band rather than an exact figure, for good reason: an exact balance in a log is sensitive data. A band such as 500-1000 tells a buyer what they can transact with while keeping the precise figure out of circulation.

• Balance is reported as a band, not an exact figure
• A band is enough to plan a transaction size
• Exact balances in logs are sensitive
• Bands age quickly as funds are spent
• Recency matters more than the band itself

What validation cannot prove

No amount of validation guarantees a transaction will be approved at a particular merchant. Issuers apply additional rules that are not visible to a validator: merchant category restrictions, country restrictions, velocity limits and their own risk models. Treat validation as a filter that removes bad input, never as a guarantee.

• Merchant category restrictions are not visible to a validator
• Country and region rules vary by issuer
• Velocity limits are account-level and dynamic
• Issuer risk models are proprietary
• Validation removes bad input; it does not guarantee approval

Practical sequence

Run the cheap local checks first, then the expensive network call only on input that passes. This keeps the number of authorisation requests low, protects the issuer's systems from needless traffic, and gives a clean audit trail of exactly what was checked and when.

• Step 1: normalise and format-check the input
• Step 2: Luhn and length validation locally
• Step 3: issuer authorisation, only if the local checks pass
• Step 4: record the response code and timestamp
• Step 5: escalate only on a specific, recorded failure