Essential Knowledge Sharing on Virtual Cards

Here is the essential knowledge about Virtual Credit Cards (VCC) shared:

A) AVS Verification System
The AVS (Address Verification System) and CVV2 are used to check the identity of the card user and cardholder, thereby controlling credit card fraud. AVS is essentially a credit card address verification system that mainly verifies the billing address provided by the credit card user against the address of the credit card issuing center. As for the CVV2, it refers to the three digits next to the signature on the back of your credit card, which can be understood as the password of the credit card.

However, currently, the AVS system can only verify numerical information and not other details. It verifies the zip code, house number, and room number provided in the billing address and then provides feedback through letters, which represent varying degrees of compliance. Merchants can set these standards to require complete compliance, partial compliance, or no verification. This is why some transactions requiring AVS verification can be approved by just correctly entering the zip code.

Currently, only a few countries' Visa and Mastercard support AVS, including the USA, Canada, and the UK. American Express cards only support the AVS in the USA; cards from other countries are not supported at all. Therefore, virtual cards & credit cards from countries other than those mentioned above should not worry about passing the AVS, as it’s a non-issue.
Regarding the information returned by AVS: 'Y' for matching information, 'N' for non-matching information, and 'P' for prepaid cards. Therefore, the vast majority of prepaid cards have no billing address, and whatever billing address you fill in, AVS will return 'P' (P stands for Prepaid card).

B) Card BIN Information
The card BIN, which stands for Bank Identification Number, refers to the first six digits of the card. The first six digits of the cards issued by the same bank, of the same type, are identical. These six digits help define the issuing bank, card type (credit, debit, or prepaid), the issuing country, card level (personal, business, platinum, standard, etc.), and card currency. Most credit card fraud prevention systems are integrated with third-party BIN databases, and most cards are listed in these databases.

C) Credit Card Fraud Prevention Systems
Credit Card Fraud Prevention Systems have evolved to be more powerful and intelligent, capable of analyzing big data to identify risks and make appropriate decisions. These typically include bank-side risk control systems and online merchant-side fraud prevention systems (general payment gateways integrate these control systems). The operating principles and algorithms of these systems are core secrets, and the factors and details used to identify risks in the system will not be disclosed.
The types of risk identification generally include:
AVS verification returned information, card BIN information, IP information (blacklist, whitelist, residential & datacenter, etc.), ordering computer system and browser fingerprint, and card fingerprint (card fingerprint);
The system evaluates hundreds of factors to score the risk level of a transaction; typically, transactions scoring above a certain threshold are immediately rejected, scores within a certain range or triggering certain risk factors are pending for manual review, and scores below a certain threshold are automatically approved.
Of course, the above is just a basic workflow. Actual conditions are much more complex, like Amazon's own risk control system, which, besides the aforementioned factors, also considers the risk factors of the ordering account (environment configuration at registration, past behavior fingerprint of the account, etc.) that affect the pass rate of orders.

The image below clearly shows the customizable risk control rules provided by a payment provider to merchants.

The last image clearly states the risk control strategy: "Automatically assess the risk level of payments through machine learning, block all payments with a risk score over 75."

Additionally, the risk control system includes blacklists based on multiple dimensions, and transactions matching any dimension of the blacklist will be blocked.

The ordering browser environment configuration, particularly the IP address, is critical. If the ordering IP (or IP range) is on the blacklist, there is a high probability that the merchant (acquiring bank) will reject the transaction. Credit card fraud is rampant abroad, leading to many public & anonymous IPs actually being blacklisted; various datacenter IPs (VPNs, etc.) found online and contaminated shared residential IPs often result in low pass rates for orders. For businesses involving multi-account operations, a clean IP and browser environment configuration are crucial.