Read the result word your provider actually stored, and use only that provider's definitions. On a Stripe charge, the security-code, street-address, and postal-code checks can be pass, fail, unavailable, unchecked, or null. Stripe says a fail means the bank checked the value and it did not match, and also says a bank can still approve the charge. A pass is not proof the buyer is the cardholder. Do not store the security code after authorization, and do not invent one accept-or-reject rule for every result. Describe the work you need. Prism will confirm scope, responsibilities, fees, and terms before work begins.
For: An owner or authorized representative of a research-use-only peptide business whose payment screen shows an address or security-code result.
Updated 2026-09-21
The check compares what was sent with the issuer's file
Stripe says that when a card payment is submitted, it provides the security code, postal code, and billing street address for the card issuer to verify, if checkout collected them. The issuer compares those values with the information it has on file. If the information was not collected, Stripe says the issuer cannot perform the check.
The security code is the three- or four-digit number printed on the card. Stripe says businesses cannot store that number. PCI DSS treats card verification codes as sensitive authentication data and prohibits storing them after authorization, even if encrypted. They may be collected only when necessary for authorization. A support note, a spreadsheet, or the consultation form is not a place to keep one.
This page is about those verification results. It is not the buyer's research-use acknowledgment, not an identity-document check, and not the 3D Secure challenge. Those are different records.
Stripe's result words
Stripe's support article for the charge says address_line1_check, address_postal_code_check, and cvc_check are on the charge under payment_method_details.card.checks. The values are pass, fail, unavailable, unchecked, or null. Pass means the bank checked the value and it was correct. Fail means the bank checked it and it was incorrect. Unavailable means the value was provided but the bank explicitly did not check it. Unchecked means the value was provided but the bank has not checked it yet. Null means the value was not collected.
Stripe says some issuers do not support one or more of these checks, and Stripe then returns unavailable. Its verification guide says address-check support varies by country and issuer. Some countries do not use a postal code, and some issuers do not support street-address verification. Stripe says most cards issued in the United States, Canada, and the United Kingdom support street-address verification. That is a statement about issuer support, not a statement that every order from those countries was checked.
These five words are Stripe's. Another provider may say match, no match, or something else. Ask that provider for its current list before reusing this table.
A fail is not a decision, and a pass is not certainty
Stripe's verification guide says a failed security-code or postal-code check can indicate fraud, so the payment should be reviewed before fulfillment. It also says address checks can fail for a legitimate payment, for example when the buyer mistypes an address or moves without telling the issuer. Its support article says that, without a specific block rule, the bank can still approve a charge when the security-code or postal-code check fails, because the bank uses other signals.
Stripe also says a security-code check does not protect against a physically stolen card, or against a computer or website with poor security. A pass means the submitted value matched the issuer's file on that check. It does not, by itself, identify the person who placed the order.
Stripe documents an optional Radar rule that can block some payments which fail the security-code check, and a separate rule for a failed postal-code check. The security-code rule does not affect payments where the check could not be performed or is unavailable. Whether your account has either rule enabled is a fact on that account, not a rule this page can set. There is no single combination of pass and fail that this page treats as accept or reject.
What the team may decide
The team can record the three result words, whether the charge succeeded, and who reviews a fail before the order is fulfilled. The team can ask the provider which block rule, if any, is enabled. The team cannot reconstruct a security code that was not stored, and should not ask the buyer to send one by email.
The issuer performs the check. The provider, or the bank, decides whether the charge is approved. Prism can discuss how the checkout collects the address and how a provider's question relates to the site. Keep card data out of the inquiry. Any rule change requires authorized implementation, and the merchant must make its order-release decision using the relevant provider records.
Results from a provider other than Stripe, and the issuer's reason for an unavailable result on a particular card, are unknown until that provider or issuer states them.
Verification-result reading sheet
Copy the result words from the provider payment. Do not copy the security code. If the provider is not Stripe, replace the definitions with that provider's current list instead of using this one. Worksheet entries are not submitted by this worksheet or saved by this site. Use only non-sensitive summaries; do not enter credentials, government identifiers, card or bank-account numbers, private receipt links, or customer details.
Worksheet entries are not submitted by Prism’s worksheet and are not saved by the site. Use record types, availability, anonymized observations, or match/mismatch results. Do not enter government identifiers, customer names or addresses, customer messages, receipt-access links, card or bank details, passwords, or keys. Send sensitive documents only through the provider’s verified secure channel.
Verification-result reading sheet. The last column is for temporary notes.
Result on the payment
What Stripe says that word means
What it does not decide
Your note
Security-code result
What Stripe says that word meansPass means the bank checked it and it matched. Fail means the bank checked it and it did not. Unavailable means the bank did not check it. Unchecked means it is not checked yet. Null means it was not collected.
What it does not decideIt does not prove who placed the order, and a fail can still be an approved charge.
Street-address result
What Stripe says that word meansStripe uses the same pass, fail, unavailable, unchecked, and null meanings for the street-address check on the charge.
What it does not decideSupport varies by issuer. A fail can be a mistyped or outdated address.
Postal-code result
What Stripe says that word meansStripe uses the same result words for the postal-code check. Some countries do not use a postal code.
What it does not decideA failed postal check is not, by itself, an instruction to cancel the order.
Charge status beside the checks
What Stripe says that word meansStripe says the bank can approve a charge even when the security code or postal code did not match, unless a block rule stops it.
What it does not decideThe approval and the check result are two fields. Record both.
Where the security code is not kept
What Stripe says that word meansPCI DSS prohibits storing the card verification code after authorization, even encrypted. Stripe says businesses cannot store it.
What it does not decideConfirm the code is absent from notes, email, and this sheet.
Who reviews a fail
What Stripe says that word meansStripe says to review a failed security-code or postal-code check before fulfillment. The reviewer is someone on your team or the provider, not a universal rule.
What it does not decideName the person who looks at the provider payment before the order moves.
These are temporary notes. Leaving or reloading this page may clear them. The consultation form does not include these entries.
Limits
A Prism consultation can help you organize the facts and discuss the website or processing question. The payment provider decides eligibility, pricing, reserves, and whether an account is opened or closed.
The result vocabulary on this page is Stripe's charge check. It is not a code list for every provider.
No accept, reject, or Radar setting is prescribed. The provider account shows which rule is on.
Do not send security codes, card numbers, or customer lists through the public consultation form.
Card verification checks — checked 2026-09-21. Stripe submits the security code, postal code, and street address when they were collected. A failed check can indicate fraud and can also happen on a legitimate payment. Address support varies by country and issuer. Businesses cannot store the security code. Radar block rules do not cover checks that could not be performed.
Stripe charge check values — checked 2026-09-21. On a charge, the three checks are pass, fail, unavailable, unchecked, or null, with the meanings used on this page. Some issuers return unavailable. A charge can succeed when the security code or address was incorrect.
Charge succeeded despite a mismatch — checked 2026-09-21. Without a block rule, the customer's bank can approve a charge even when the security-code or postal-code check fails.
PCI SSC card-verification FAQ — checked 2026-09-21. Merchants may request a card verification code for a card-not-present authorization. PCI DSS Requirement 3.3.1.2 prohibits storing it after authorization, even if encrypted.
Prism contact — checked 2026-09-21. The consultation form tells the merchant to leave out payment card details, passwords, and customer records.
Request a consultation
Describe the business and this specific question. Prism follows up by email to discuss fit and scope. An inquiry is not a processing application or an approval.