A CC checker is a validation pipeline, not a single test — and every layer of that pipeline exists because the layers below it lie. The Luhn layer confirms the number is arithmetically well-formed (catches typos, nothing else). The BIN layer resolves issuer, brand, country, and card type from the first six-to-eight digits. The gate layer is the only layer that tells the truth: a real authorization request against a real payment processor's live API, where "live" means the issuer would approve a charge, "decline" means the specific reason the issuer said no, and "ban" means the processor's fraud layer noticed you asking. This is checker-making decoded: the four-layer architecture, how the gate layer actually works (donation-endpoint authorizations, key rotation, response classification), the threading and proxy discipline that keeps ban rates down, and the output sorting (live, dead, banned, VBV vs non-VBV) that turns raw results into something a pipeline can consume.
ROUTE MAP (PLAIN ENGLISH)
The four layers run in strict order, each one cheaper than the last-to-fail: Luhn prefilter (milliseconds, zero network — kills malformed numbers before any request fires, which is why a checker burning proxy bandwidth on Luhn-dead lines is misconfigured at layer one), BIN lookup (local database hit or API call — resolves brand, type, country, issuer, and often whether the BIN is prepaid, commercial, or debit, which feeds sort logic and sometimes gate routing), gate request (the authorization attempt against a processor's live endpoint — the only layer with ground truth), and result classification (the response parsed into live, dead-with-reason, ban, or captcha-park classes, written to separate output files). A checker without the prefilter wastes resources; a checker without the gate layer is a Luhn calculator with extra steps that tells you nothing about whether a card would ever authorize — the distinction that separates public "checkers" (Luhn-only, zero real information) from gate checkers (real authorization status).
The gate layer's mechanics deserve precision because this is where most homemade checkers fail. The authorization request goes to a real payment processor's live API (Stripe being the common integration in open tooling) — often through an indirect endpoint like a donation form's payment-intent creation, which runs a real authorization against the issuer without capturing funds. The response codes carry the ground truth: requires-action or succeeded-class codes mean live (the issuer approved to the authorization stage), card-declined with specific decline codes (insufficient funds, do-not-honor, invalid CVC, expired) mean dead-with-reason, authentication-required codes map to the 3DS/VBV branch, and processor-level rate-limit or account-flag responses mean the checker's own key or IP got burned — a ban on the tooling side, not a statement about the card.
STEP 1 - LAYER ONE AND TWO: PREFILTER AND BIN
STEP 2 - THE GATE LAYER, ACTUALLY
STEP 3 - PROXIES, THREADING, AND POOL HEALTH
STEP 4 - OUTPUT SORTING AND VBV CLASSIFICATION
WORKED EXAMPLE - A FULL PASS, LAYER BY LAYER
Input stack: 10,000 lines of number|mm|yy|cvv. Layer one: Luhn + length + test-range filters kill 3,200 malformed lines and park 40 sandbox numbers in test.txt — 6,760 proceed. Layer two: BIN resolution enriches each line, parks 300 lines from issuer ranges the gate does not service (reason recorded), routes 6,460 to the gate queue. Layer three: 10 threads, each bound to a residential proxy for the run's life, six-second per-thread delays, key pool of four sk_live credentials on weighted rotation — first three authorizations return card-declined with insufficient-funds and do-not-honor codes (written to dead.txt with reasons), the fourth returns succeeded-class (live.txt, no-3ds flag), the eighth returns authentication-required (live.txt, 3ds flag set), the fifteenth returns a rate-limit processor code on one key (key cools, key-ban logged to ban.txt with timestamp — not a card verdict), one line times out and retries on the thread's same proxy once before succeeding. Throughput: ~100 authorizations/minute, ban-rate 12 per 1,000 across the run — healthy. Final tally: 412 live (267 non-3DS, 145 3DS-flagged), 5,890 dead-with-reasons preserved, 118 key/ip-ban tooling events, 340 captcha-parked when the gate fronted a challenge page in the run's second hour — every class in its own file, every record enriched with BIN metadata, the run report showing the ban-rate climb starting exactly when provider-range "residential-a" entered the pool rotation, which is the next range to pull.
WORKING SEQUENCE
QUICK ANSWERS
RELATED
The four layers run in strict order, each one cheaper than the last-to-fail: Luhn prefilter (milliseconds, zero network — kills malformed numbers before any request fires, which is why a checker burning proxy bandwidth on Luhn-dead lines is misconfigured at layer one), BIN lookup (local database hit or API call — resolves brand, type, country, issuer, and often whether the BIN is prepaid, commercial, or debit, which feeds sort logic and sometimes gate routing), gate request (the authorization attempt against a processor's live endpoint — the only layer with ground truth), and result classification (the response parsed into live, dead-with-reason, ban, or captcha-park classes, written to separate output files). A checker without the prefilter wastes resources; a checker without the gate layer is a Luhn calculator with extra steps that tells you nothing about whether a card would ever authorize — the distinction that separates public "checkers" (Luhn-only, zero real information) from gate checkers (real authorization status).
The gate layer's mechanics deserve precision because this is where most homemade checkers fail. The authorization request goes to a real payment processor's live API (Stripe being the common integration in open tooling) — often through an indirect endpoint like a donation form's payment-intent creation, which runs a real authorization against the issuer without capturing funds. The response codes carry the ground truth: requires-action or succeeded-class codes mean live (the issuer approved to the authorization stage), card-declined with specific decline codes (insufficient funds, do-not-honor, invalid CVC, expired) mean dead-with-reason, authentication-required codes map to the 3DS/VBV branch, and processor-level rate-limit or account-flag responses mean the checker's own key or IP got burned — a ban on the tooling side, not a statement about the card.
STEP 1 - LAYER ONE AND TWO: PREFILTER AND BIN
- Luhn implementation: the modulus-10 checksum — reverse the number, double every second digit, sum with the >9 digit-fold rule, total divisible by 10 = arithmetically valid; runs locally in microseconds per line, kills transposition typos and random digit strings before any network cost; additional cheap filters at this layer: length checks per brand (Visa 13/16/19, Amex 15, MC 16), prefix-range checks, test-card-range blacklists (the 4242/4111-style sandbox numbers get routed to a test file, not mixed into live results), and duplicate-line dedupe across the input batch.
- BIN database: local BIN tables (updated periodically from community datasets) resolve the first six-to-eight digits to brand, level (classic, platinum, business), type (credit, debit, prepaid), country, and issuer name — local lookup beats API lookup on speed and privacy; API fallback (bincodes-style services or processor metadata endpoints) fills gaps the local table misses; the resolution feeds sort keys (country-based routing, prepaid flagging) and enriches the output record alongside the gate result.
- Input format discipline: the universal mass-check format is number|mm|yy|cvv per line (some stacks carry |name| fields too); the parser must normalize variants before the prefilter — yyyy-to-yy truncation, space/dash stripping, cvv missing-column detection (lines without cvv route to a cvv-less sort, not into the main gate queue silently); input normalization is the layer-one debugging surface: most "everything dies instantly" reports are a stack format mismatch, not a gate problem.
- Pre-gate routing: cards whose BIN resolves to unsupported regions, blocked issuers, or categories the gate cannot service get parked before the gate queue (their own output file with the reason), keeping the gate's thread pool focused on checkable lines and keeping ban-rate math clean — mixing uncheckable lines into the gate queue corrupts the ban-rate-per-proxy diagnosis that keeps the pool healthy.
STEP 2 - THE GATE LAYER, ACTUALLY
- Authorization vs capture: the gate runs an authorization (a real approve/decline decision from the issuer) without capturing funds — payment-intent creation against a live key through an endpoint that authorizes then releases (donation-page flows and zero-auth-style integrations are the common patterns in open tooling); the authorization is real, which is why the issuer's fraud models see it, which is why rate and proxy discipline at this layer are existential rather than cosmetic.
- Key lifecycle: the processor key (sk_live-class credentials) is the checker's most burnable asset — keys accumulate risk score as their authorization velocity rises and as declined-then-approved patterns look like testing; key rotation (multiple keys in a pool, weighted round-robin, cooldown after ban-class responses) is standard; a banned key produces processor-level error responses that must classify as key-ban (not card-dead), because misclassifying key-bans as card-deaths poisons the dead.txt file with perfectly good cards.
- Response classification: the gate's JSON response codes map to the output classes — succeeded/requires-action codes → live (with a 3DS flag where authentication-required appears, feeding the VBV sort), card-declined variants → dead with the specific decline code preserved in the output record (insufficient-funds vs do-not-honor vs invalid-cvc are different downstream information, never collapse them into one "dead"), rate-limit/account-flag/permission-denied processor codes → key-ban or ip-ban classes (tooling-side, routed to pool maintenance not result files), timeouts and network errors → retry class (retried once on a fresh proxy, then parked, never classified as dead on network failure).
- Delay and velocity: the 5-to-8-second inter-request delay class (open implementations commonly run six-second sleeps between authorizations) exists because authorization velocity per key and per IP is the processor's primary burn signal — zero-delay checkers light up risk models within dozens of requests; the delay is per-thread, so total throughput is thread-count divided by delay, which is why threading and delay math together decide the checker's real-world speed, not either one alone.
STEP 3 - PROXIES, THREADING, AND POOL HEALTH
- Proxy class matching: gate requests through datacenter pools die fastest (the processor's IP-reputation layer scores datacenter ranges aggressively); residential and mobile pools carry authorization traffic longer; the practical split: datacenter for BIN-lookup API traffic and non-gate functions, residential for gate authorizations, with per-thread proxy binding (one proxy per thread for the thread's lifetime, not rotating per request — session consistency again, same fingerprint logic as configs: authenticated flows do not change IPs mid-call).
- Thread pool design: async request loops with a worker pool sized against the delay math (10 threads at six-second delay ≈ 100 authorizations/minute theoretical, less with real-world variance); the pool reads the normalized prefiltered queue, each worker binds its proxy for life, pulls a line, runs the gate, classifies, writes to the appropriate output file with a lock; graceful pause/resume and live counters (live/dead/ban/captcha tallies) are the minimum viable operator surface.
- Ban-rate monitoring: the metric that keeps checkers alive — bans per 1,000 authorizations, graphed per proxy provider and per key; a rising ban-rate concentrated in one provider range = rotate that range out; spread across all providers = key risk score climbing, rotate keys or cool the pool; uniform low bans with high declines = healthy gate, the checker is doing its job.
- Failure-mode taxonomy: all-dead-instantly (check layer-one input format and key validity first — a dead key reads as universal decline if key-ban classification is missing), all-ban (proxy reputation or key burn, not card data), mixed-live-and-dead with normal ban-rate (healthy checker — the distribution is the information you paid for), captcha-class spike (the gate started fronting a challenge layer — route to solve integration or cool down, per the anti-captcha thread's branching logic).
STEP 4 - OUTPUT SORTING AND VBV CLASSIFICATION
- Output file classes: live.txt (authorized cards with full record: number|mm|yy|cvv|brand|country|issuer|decline-reason-when-relevant|3ds-flag), dead.txt (declined with the specific decline code preserved per line), ban.txt (tooling-side burns: key-bans and ip-bans with timestamps for pool correlation), captcha.txt (parked challenge-class responses for later solve passes), test.txt (sandbox-range numbers intercepted pre-gate); every class gets its own file because the downstream pipeline consumes them differently — mixing classes is how dead cards end up in live workflows.
- VBV / 3DS sort: authorization responses carrying authentication-required codes mark the card as 3DS-gated (Verified-by-Visa-class / Mastercard-SecureCode-class / modern 3DS2 challenge flows) — the flag goes in the live record because the downstream consumer's method must handle the challenge step; non-3DS authorizations (straight approve) sort into the non-VBV bucket; the split is response-derived, never BIN-assumed — BIN-level 3DS assumptions mis-sort cards whose issuer enrolls differently than the BIN's default.
- Enrichment: BIN metadata (brand, level, country, issuer, prepaid flag) joins each output record so downstream tools filter by geography or card level without re-resolving; decline-code preservation on dead lines feeds BIN-level analysis (a BIN whose declines cluster on insufficient-funds versus do-not-honor tells different stories about the bin's quality).
- Run reports: the summary layer — totals per class, ban-rate per provider, average latency per gate, throughput per hour — is what turns a batch into an operational decision (keep running, rotate keys, cool proxies, fix classification); checkers without run reports fly blind on the exact metrics that predict when the next ban wave hits.
WORKED EXAMPLE - A FULL PASS, LAYER BY LAYER
Input stack: 10,000 lines of number|mm|yy|cvv. Layer one: Luhn + length + test-range filters kill 3,200 malformed lines and park 40 sandbox numbers in test.txt — 6,760 proceed. Layer two: BIN resolution enriches each line, parks 300 lines from issuer ranges the gate does not service (reason recorded), routes 6,460 to the gate queue. Layer three: 10 threads, each bound to a residential proxy for the run's life, six-second per-thread delays, key pool of four sk_live credentials on weighted rotation — first three authorizations return card-declined with insufficient-funds and do-not-honor codes (written to dead.txt with reasons), the fourth returns succeeded-class (live.txt, no-3ds flag), the eighth returns authentication-required (live.txt, 3ds flag set), the fifteenth returns a rate-limit processor code on one key (key cools, key-ban logged to ban.txt with timestamp — not a card verdict), one line times out and retries on the thread's same proxy once before succeeding. Throughput: ~100 authorizations/minute, ban-rate 12 per 1,000 across the run — healthy. Final tally: 412 live (267 non-3DS, 145 3DS-flagged), 5,890 dead-with-reasons preserved, 118 key/ip-ban tooling events, 340 captcha-parked when the gate fronted a challenge page in the run's second hour — every class in its own file, every record enriched with BIN metadata, the run report showing the ban-rate climb starting exactly when provider-range "residential-a" entered the pool rotation, which is the next range to pull.
WORKING SEQUENCE
Code:
checker stack: normalize input (number|mm|yy|cvv) -> Luhn+length+test-range prefilter (local, zero network) -> BIN resolve enrich + route (local DB, API fallback) -> gate: authorization-only against live processor endpoint (donation-flow pattern), key pool with rotation, per-thread residential proxy binding, 5-8s delay -> classify: live (+3ds flag from auth-required codes), dead (preserve decline reason), key-ban/ip-ban (tooling-side, pool maintenance), captcha-park -> output: separate files per class, BIN-enriched records, run report with ban-rate per provider per key -> VBV sort is response-derived (auth-required code = 3DS), never BIN-assumedQUICK ANSWERS
- What is the difference between a Luhn checker and a real CC checker? Luhn-only tools (most public "checkers") validate arithmetic well-formedness — they catch typos and nothing else, telling you zero about whether a card would ever authorize; a real gate checker runs an actual authorization request against a live payment processor and returns the issuer's real decision (live, specific decline, or tooling-side ban) — the only layer with ground truth.
- How does the gate layer actually work? An authorization-only request against a live processor API (commonly a payment-intent flow through an endpoint like a donation form) — the issuer approves or declines for real, no funds captured; response codes classify: succeeded/requires-action = live, card-declined variants = dead with the specific reason preserved, processor rate-limit/permission codes = key or IP burn (tooling-side, not a card verdict), authentication-required = live with a 3DS flag.
- Why does my checker return all dead instantly? Three usual suspects in order: input format mismatch (stack parsed wrong so every request carries malformed data — check the prefilter layer first), a burned key (key-ban responses misclassified as card-dead because key-ban class keys were never defined — add processor-error keys before decline keys), or missing CVV columns routing empty fields that decline universally — a single-line manual run with full response logging shows which of the three in under a minute.
- What proxies should the gate layer use? Residential per-thread binding (one proxy per thread for the thread's whole life, not rotating per request — session consistency); datacenter ranges die fastest against processor IP-reputation scoring and belong on BIN-lookup traffic, not gate authorizations; ban-rate per provider gets graphed so dead ranges rotate out before they contaminate the whole run's results.
- What is VBV/non-VBV sorting? Response-derived 3DS classification: authorizations returning authentication-required codes are 3DS-gated (the downstream method must handle a challenge step) — they sort to the VBV bucket with the flag in the live record; straight-approve authorizations sort non-VBV; the split comes from each authorization's actual response, never from BIN-level assumptions, because issuer enrollment varies within the same BIN.
- Why the six-second delay between checks? Authorization velocity per key and per IP is the processor's primary burn signal — zero-delay checkers light risk models within dozens of requests; the delay is per-thread, so throughput = thread count divided by delay — 10 threads at six seconds ≈ 100 authorizations/minute — and rising ban-rate without delay changes usually means key risk-score accumulation, which needs key rotation or cooldown, not faster checking.
RELATED