Card Security Code

Question

We have implemented the Card Security Code check when using credit cards.

This produced a value on the attribute security_code_check of passed, failed, unknown.

Balanced state "It's strongly recommended you do not process transactions with cards that fail this check."

However the security code check is not done until an authenticated operation is performed against it the card.

So by the time the check is done we have attempted to process the card. So how do we follow the advice not to use it?

Answer 1

You would create a hold on the card first. If the CSC succeeds, capture the hold. If it fails, void the hold.

Answer 2

Creating a hold on the Card to do this is wrong and unnecessary. Doing so ties up a customer's available funds and causes confusion.

An authenticated request claims a tokenized funding instrument to a marketplace, which triggers Card verification at the same time. This is discussed in several places in the documentation, chiefly in https://docs.balancedpayments.com/1.1/guides/balanced-js. If you wish to check the CVV result before attempting to charge the card, you should perform an authenticated request on the Card such as a GET, or even associate the Card to a Customer resource. This will initiate the Card verification and provide the ability for you to check the verification results before attempting to charge the Card. Immediately attempting to debit the Card does not provide such an opportunity.

Answer 3

"However the security code check is not done until an authenticated operation is performed against it the card."

An authenticated operation includes performing a GET on the card token returned by balanced.js, which is required to store the card anyway. It is not required to debit the card first.