Zero-Value Authorization

A zero-value authorization is a card authorisation request sent for an amount of zero. Its purpose is to confirm that a card account is open and in good standing, and to run checks such as address verification and the card security code, without charging the cardholder or reserving any of their funds. Merchants use it when they need to store a card for future use, for example when a customer starts a free trial, signs up for a subscription, books a hotel room or adds a card to an app.

Card schemes call this kind of request an account verification, and zero-value authorisation is the standard way to perform account verification on Visa and Mastercard. It replaced the older practice of authorising a nominal amount such as one dollar and then reversing it, which left temporary holds on cardholders' accounts and caused confusion.

The merchant or its payment gateway sends an authorisation message with an amount of zero and an indicator that it is an account verification. The request passes through the acquirer and card network to the issuer, as any authorisation would. The issuer checks that the card number, expiry date and account status are valid, and if the merchant included them, compares the billing address through the address verification service and the card verification value. The response tells the merchant whether the card is valid, plus the results of the address and CVV checks.

Because no amount is involved, there is no authorization hold and nothing to capture or settle. The cardholder may see nothing at all, or in some banking apps a brief zero-amount entry. Not all issuers in all regions support zero-amount requests, and some older systems decline them, so gateways sometimes fall back to a small-amount authorisation that is immediately reversed.

Zero-value authorisations are used wherever a merchant wants to confirm a card before charging it:

• Storing a card on file. When a customer saves card details for future purchases, the merchant verifies the card and records the first use as the start of a stored credential relationship. Scheme rules on card-on-file transactions require the initial transaction, which may be a zero-value verification, to be flagged correctly so later merchant-initiated transactions can refer back to it.
• Free trials and subscriptions. A subscription service verifies the card at sign-up and only charges when the trial ends.
• Bookings and deposits. Hotels, car hire firms and restaurants check that a card is valid when taking a reservation, before any charge is due.
• Wallet and token set-up. When a card is added to a digital wallet or tokenised, the issuer may receive a verification request as part of provisioning.

Zero-value requests do not attract interchange, since no purchase is made, but acquirers and processors usually charge their normal per-authorisation fee, and the card networks may charge small network fees for account verification messages. The schemes have encouraged or required merchants to use zero-value verification instead of nominal-amount authorisations, and may charge or penalise merchants that use small-amount authorisations for verification purposes. Merchants also need strong customer authentication in Europe when a cardholder sets up a stored card for future merchant-initiated payments, which is typically done alongside the verification.

Because zero-value requests cost the fraudster nothing and leave no trace on the cardholder's statement, they are a favourite tool for card testing. Criminals submit large numbers of stolen or guessed card numbers through a merchant's "save card" or sign-up form to find out which ones are live, then use the working cards elsewhere. The merchant pays authorisation fees for every attempt and may be flagged by its acquirer or the schemes for excessive declines. Merchants protect verification flows in the same way as checkout: with rate limits and velocity checking, CAPTCHA tests, device fingerprinting and monitoring for bursts of failed verifications from the same source.

Issuers, for their part, apply fraud scoring to verification requests and may decline those that look like testing. A successful zero-value authorisation is evidence only that the card was valid at that moment; it does not guarantee that later payments will be approved, since the card can be closed, blocked or short of funds when the merchant eventually charges it.