KEY TAKEAWAYS
- Checking is legal when you are authorised to process the cards.
- Verifying third-party cards without authorisation is unlawful, regardless of tooling.
- Legitimate uses: stored-card hygiene, integration testing, risk signals.
- Our terms require authorised use; abuse is actionable.
- History retains checker legality results for the retention window, then purges them.
- Every checker legality result class should map to a defined workflow action.
This is the most important question in this space, and the honest answer is short: checking is a payment-operations tool, and its legality depends on authorisation — not on the software.
The rule that matters
You may verify cards you own, or cards you are explicitly authorised to process (for example, your own customers' stored payment methods on your own platform, or test/sandbox cards). Verifying cards you do not control is not a technical question — it is unauthorised use of payment credentials, and that is illegal in most jurisdictions.
Normal, legitimate uses
Merchants validating stored payment methods before billing runs. Developers testing their own integrations. Risk teams enriching fraud models with status signals on cards they process. Payment providers verifying test ranges in staging.
Platform safeguards
Our terms require lawful, authorised use. Accounts are protected by login lockout, bot protection and rate limits; abuse can be reported. We recommend keeping Turnstile enabled for public registration.
In practice
If you have to ask whose card it is, stop. If the card belongs to you or your customer and you have a lawful basis to verify it, a checker is simply a maintenance tool — the same category as a payment gateway dashboard.
Card verification is a lawful, ordinary business activity when it is applied to cards you own or are authorised to process — your own accounts, customer cards held under agreement, or test cards in your own sandbox. The tools are neutral; the authorisation to use them on a given card is what the law cares about.
What is not lawful, anywhere, is using verification against cards you have no relationship with. That is not a grey area, and the platform treats it as prohibited: accounts used for unauthorised checking are subject to suspension. Operators also carry their own obligations — data protection, card-network rules, and the terms under which they hold card data — which is why the platform keeps the technical footprint deliberately narrow: no charges, no data trading, account-scoped history.
Key points about checker legality
- Lawful when applied to cards you own or are authorised to process.
- Unauthorised checking is prohibited and enforced.
- The platform moves no money and trades no card data.
- Operators remain responsible for their own legal basis and record-keeping.
Reading checker legality results honestly
Conflating outcomes is the most expensive habit in this area — an error treated as a dead card discards real inventory, and an unknown treated as live inflates confidence. A live answer is evidence about the account, not a guarantee about a specific future transaction; issuer rules can change between the check and the charge. Dead results are conclusive for the moment and should never be re-checked in the same run; retries on dead cards spend balance for identical answers. Classified rate is the share of cards that produce a definitive answer; it is the first number to compare when switching gateways. Holding that line is what makes checker legality reliable over time.
Running checker legality well: the operating steps
Size batches to the provider ceiling. Past that line, extra concurrency converts into timeouts rather than throughput. Deduplicate before submitting: the same card in a list twice is billed twice if both copies classify. Decide how each outcome is handled before the run starts; a triage plan written after the results arrive is usually just a spreadsheet. Run one primary gateway with a fallback route. When the primary degrades, re-run only the unclassified remainder on the fallback. In checker legality work, that is the difference between a signal and a guess.
Limits and responsible use of checker legality
A check does not move money, does not create a charge and does not touch the cardholder's credit file. Results describe the account, never the person; they should inform routing and risk decisions, not identity decisions. Operators remain responsible for the legal basis on which they hold and process card data. It sounds obvious until a real run tests it.
The mechanics behind checker legality
The four outcomes are categorical rather than numeric because decisions are categorical too: proceed, recover, retry or log. Error means the check itself failed technically: a timeout, a provider fault or malformed input. No classification was produced, and no charge applies. Dead means the account is closed, blocked or invalid. It is a final answer for the current state of the card and should never be retried blindly. The platform keeps one history row per request with status, cost and before/after balance, which makes the whole loop auditable at the individual check level. The habit costs nothing and removes a recurring class of mistakes.
Checker legality in numbers
When the classified rate moves, the cause is usually a route or provider change rather than the underlying cards. The reference BIN table covers hundreds of thousands of issuer ranges, and it is deliberately separate from account-status data: one describes issuers, the other describes cards. Latency percentiles matter more than averages: the p90 and p99 tell you what a slow run actually feels like. Aggregate numbers describe populations, not individual cards. Use them to size timeouts and retry budgets, never to judge one account. That distinction is what keeps checker legality decisions clean.
Operating checker legality at scale
Track cost per classified card rather than cost per request; it is the only metric that reflects retries and unknown rates. Treat provider outages as routing problems: switch routes, recover the unclassified remainder, keep the answers you already paid for. Schedule recurring checks ahead of the decisions they inform, not after them. Document the route, the batch policy and the retry rules next to each production run; six months later that note is the diagnosis. It is a small rule that changes how checker legality behaves at scale.
Failure modes to design out of checker legality
Storing card data beyond the needs of checker legality creates risk without adding value. Validating after the paid checker legality request, rather than before, doubles the cost of bad input. Retrying a dead card during checker legality spends balance for an answer that will not change within the run.
- Defining result handling after the run in checker legality produces spreadsheets instead of decisions.
- Validating after the paid checker legality request, rather than before, doubles the cost of bad input.
- Mixing test numbers into production checker legality lists creates results that mean nothing.
- Increasing parallelism past the provider ceiling in checker legality converts capacity into timeouts.
Boundaries of checker legality
Operators remain responsible for the legal basis on which they hold and process card data. The platform does not trade card data, and nothing in the system is designed to bypass a cardholder's consent. High-value decisions deserve fresh checks; stale results drift as accounts change. Write it down; checker legality workflows live and die on small consistencies.