Bulk Card Verification Script

This script turns a CSV of cards into a CSV of classified results. It validates locally first, uses bounded concurrency, retries only transient errors and never logs card data.

The script

import csv, os, time, requests
from concurrent.futures import ThreadPoolExecutor, as_completed

API = "https://c4check.com/api/v1/api.php"
KEY = os.environ["CARD_CHECKER_API_KEY"]
GATEWAY = os.environ.get("CARD_GATEWAY", "new")

def luhn(n):
    d = [int(c) for c in n if c.isdigit()]
    if not 12 <= len(d) <= 19: return False
    s, alt = 0, False
    for x in reversed(d):
        if alt: x *= 2; x -= 9 if x > 9 else 0
        s += x; alt = not alt
    return s % 10 == 0

def check(row, tries=3):
    card = row["card"].strip()
    digits = "".join(c for c in card if c.isdigit())
    if not luhn(digits):
        return {"card": card, "result": "INVALID_FORMAT", "balance": ""}
    for i in range(tries):
        try:
            r = requests.get(API, params={"gateway": GATEWAY, "cc": card, "json": 1},
                             headers={"X-API-Key": KEY}, timeout=60)
            if r.status_code in (429, 500, 502, 503, 504):
                raise RuntimeError("retryable")
            data = r.json()
            return {"card": card, "result": data.get("result", "ERROR"),
                    "balance": data.get("balance", "")}
        except Exception:
            if i == tries - 1:
                return {"card": card, "result": "ERROR", "balance": ""}
            time.sleep(min(8, 0.5 * 2 ** i))

with open("cards.csv", newline="") as fin, open("results.csv", "w", newline="") as fout:
    rows = list(csv.DictReader(fin))
    writer = csv.DictWriter(fout, fieldnames=["card", "result", "balance"])
    writer.writeheader()
    with ThreadPoolExecutor(max_workers=5) as pool:
        for future in as_completed([pool.submit(check, r) for r in rows]):
            writer.writerow(future.result())

Why it works well

• Local validation removes invalid rows before they cost balance.
• Bounded workers (5) respect gateway limits; tune to your settings.
• Retry policy targets transient failures only — dead results are final.
• Privacy: nothing is printed; only the output CSV holds results.

For very large lists prefer the platform's streaming checker, which reuses connections and applies global flow control. See bulk checking workflow and cost per classified card.

A bulk verification script is mostly input handling and result routing, with a small API call in the middle. Read the CSV, validate checksums and expiry, drop duplicates, iterate with bounded concurrency, classify each response, and write two outputs: a clean result file and a retry file for unknowns and errors.

The patterns below keep the script safe at volume: the key from the environment, a timeout per request, and a bounded retry count on the free error class only. Never retry dead or live results.

A concrete bulk verification scripting example

import csv, os, requests
from concurrent.futures import ThreadPoolExecutor

KEY = os.environ["C4CHECK_KEY"]

def check(row):
    r = requests.get("https://c4check.com/api/v1/api.php",
        params={"gateway": "GATEWAY", "cc": row["card"], "json": 1},
        headers={"X-API-Key": KEY}, timeout=30)
    return row["card"], r.json().get("result", "error")

rows = [r for r in csv.DictReader(open("cards.csv"))]
with ThreadPoolExecutor(max_workers=4) as ex:
    for card, result in ex.map(check, rows):
        print(card, result)

A machine-readable OpenAPI description is available for Postman, Insomnia and client generation. Errors produce no classification and no charge, which makes a careful retry strategy effectively free. Branch on the result field rather than the HTTP status alone: a successful response can still carry an error outcome. It sounds obvious until a real run tests it.

Automating bulk verification scripting through the API

Automation pays off on scheduled workloads: card-on-file audits and route health checks are the classic candidates. Regenerating the key takes one click on the dashboard and invalidates the old one immediately. Authenticate with the API key in a request header; a key in a URL or in client-side code is a leak waiting to happen. Add a circuit breaker: when the error rate crosses a threshold, pause the run and move the remainder to the fallback route. In bulk verification scripting work, that is the difference between a signal and a guess.

Security hygiene around bulk verification scripting

Verification data is operational data — treat it with the same care as any other sensitive business record. Regenerate the key the moment compromise is suspected; every check remains attributed in history, so the audit trail survives. Check inputs are account-scoped and retained under the platform retention window, then purged by the scheduled cleanup. Aggregate statistics are computed without exposing individual records, which is why published numbers can be useful without being risky. Remember it the next time bulk verification scripting produces an ambiguous answer.

Interpreting outcomes in bulk verification scripting

• Errors in bulk verification scripting return to the queue after the cause is fixed, because they produced no answer at all.
• Dead results in bulk verification scripting route to recovery: dunning, an update-payment prompt or list cleanup.
• In bulk verification scripting, live results route forward: billing, approval or completion, depending on the workflow.
• Unknown results in bulk verification scripting get one fallback pass on a second route, then a defined resting state.

When a result contradicts other evidence, re-check once after a reasonable interval rather than assuming the checker is wrong. Dead results are conclusive for the moment and should never be re-checked in the same run; retries on dead cards spend balance for identical answers. Classified rate is the share of cards that produce a definitive answer; it is the first number to compare when switching gateways. That single habit separates routine bulk verification scripting from expensive bulk verification scripting.

Running bulk verification scripting well: the operating steps

Log request identifiers and outcomes, never full card numbers. Debugging rarely needs a PAN, and storing one is a liability. Watch two numbers over time: the classified rate and the error rate. Together they explain almost every surprise in monthly spend. Run one primary gateway with a fallback route. When the primary degrades, re-run only the unclassified remainder on the fallback. Treat every large list as two lists: the part that classifies on the first pass, and the remainder that needs a decision about how hard to chase. That single habit separates routine bulk verification scripting from expensive bulk verification scripting.

What bulk verification scripting cannot promise

Operators remain responsible for the legal basis on which they hold and process card data. Verification is at its best when it is boring: a routine status step inside an existing, authorised process. When a proposed use cannot be explained to a compliance reviewer in one sentence, it is probably not a fit. That single habit separates routine bulk verification scripting from expensive bulk verification scripting.

Keeping bulk verification scripting predictable

Schedule recurring checks ahead of the decisions they inform, not after them. Alert on classified-rate drops, not just on errors; silent degradation is the expensive kind. Reconcile spend monthly against classified results; the difference between the two numbers is where retries hide. Keep the API key server-side and regenerable; a leaked key is a billing incident as much as a security one. It is a small rule that changes how bulk verification scripting behaves at scale.

Reading bulk verification scripting results honestly

The honest reading of unknown is "no answer yet". The card is neither good nor bad, and the remedy is a different route, not a repeat of the same one. Conflating outcomes is the most expensive habit in this area — an error treated as a dead card discards real inventory, and an unknown treated as live inflates confidence. The four result classes are a decision matrix, not a score: live proceeds, dead recovers, unknown gets one careful retry, error returns to the queue. A result is only as fresh as its timestamp. High-value decisions should use checks that ran close to the moment of the decision. It sounds obvious until a real run tests it.

Bulk verification scripting: related tools and reading

• how checking works
• results statistics
• Bulk Card Checking Guide
• Card Checker Api Python
• Csv Card List Cleaner