Payment Instrument Signals

Attributes and history of the card, token or wallet used to pay: BIN data, verification results, network data fields and cross-account reuse, applied at funding, purchase and refund decisions.

What it measures

Category	Example attributes
Instrument metadata	BIN/IIN → issuer, country, card type (credit/debit/prepaid), product tier, commercial vs. consumer; wallet token vs. PAN; virtual card indicator where available
Verification results	AVS (address match), CVV2 result, 3DS outcome (frictionless, challenged, failed, attempted), issuer decline codes
Transaction classification	Purchase vs. Account Funding Transaction (AFT) vs. Original Credit Transaction (OCT); business application / transaction-type indicators
History and reuse	First-seen date on your platform; number of accounts using the same instrument fingerprint; prior declines, disputes and refunds; time since added to the account
Consistency	Instrument country vs. IP, shipping and identity country; cardholder name vs. account name; multiple instruments from the same issuer range added in a burst

Why it matters

The instrument is where card fraud and many rewards frauds become visible to the network. In card-funded flows (wallet loads, brokerage deposits, P2P), the networks' AFT mandates mean the funding event is labeled as such, with a transaction-type classifier and (on Mastercard) recipient name. The mandates cover in-scope US merchants on Visa since January 31, 2025, US crypto, gaming and securities MCCs on Mastercard since April 30, 2025, and all Visa securities merchants globally by October 18, 2026. Issuers scrutinize these more, and merchants get a cleaner separation of "buying goods" from "moving money".

For disputes, instrument history now feeds evidence. Visa's Compelling Evidence 3.0 (effective April 2023) lets merchants contest reason code 10.4 card-not-present fraud disputes by showing two prior undisputed transactions on the same card, 120 to 365 days old, that match on specific data elements such as IP address, device ID, shipping address or account login. Historical instrument–device–account linkage therefore protects revenue as well as feeding risk models.

For rewards, the instrument often stands in for identity. Card-linked offers attach to enrolled cards, and the same card enrolled on many reward accounts is a primary Multi-Accounting signal.

By industry: Retail and Ecommerce, CNP fraud and refunds to a different card; Cashback, Coupons and Rewards, card-linked offer enrollment and redemption; Payments and P2P, card-funded sends and push-to-card payouts; Neobanks and Consumer Fintech, debit card provisioning to wallets; Brokerage and Investing, card-funded deposits.

How to collect it

From the processor/gateway: AVS, CVV, 3DS results, decline codes, network tokens, BIN data. Persist the raw response codes as well as the approve/decline outcome.
BIN databases (bought): coverage and freshness vary; prepaid and virtual identification is imperfect.
Instrument fingerprint: a stable, tokenized identifier for a card across accounts (processor-provided or your own vault token). Never store raw PANs outside PCI scope.
Network-provided risk data: network risk scores and token lifecycle events are available through some processors and issuers' programs; availability depends on your role (merchant vs. issuer).

How to use it

Combine with device and identity: instrument country ≠ device geolocation ≠ identity address is weak alone, strong together (Geolocation and Impossible Travel, Identity Element Consistency).
Reuse graph: one instrument across many accounts, or many instruments on one account/device. Feed both patterns into Entity Link Analysis. Many instruments from sequential or tightly clustered ranges attempted in a short window is a Card Testing signature.
Verification results as features: a passed 3DS shifts liability for many fraud disputes but does not prove the cardholder authorized it (phished OTPs pass), so don't treat it as an approval gate. A frictionless 3DS on a brand-new card in a risky session is still risky.
Refund routing: refunds to an instrument other than the original are a classic money-moving step in Refund and Return Fraud and Triangulation Fraud investigations.
Card-linked offers: tie offer eligibility to instrument uniqueness and first-seen date (see Card-Linked Offer Abuse).

Strengths and limitations

Strengths: rich, standardized data on every card transaction; issuer and network outcomes encode information you can't see; history supports dispute representment.

Limitations: stolen card data comes with correct CVV and billing details, so an AVS/CVV match proves possession of the data and says nothing about ownership; tokenization and wallets can obscure the underlying card from the merchant; BIN data misclassifies some products; instrument identity resets when cards are reissued. Instrument signals can be degraded by sophisticated actors, so they work best combined with device, behavior and linkage signals.

False positives and fairness

International travelers and expatriates using home-country cards.
Customers who use prepaid or reloadable cards because they are unbanked or underbanked. Penalizing prepaid outright disproportionately affects lower-income customers.
Families sharing a card across household members' accounts.
Small business owners paying from commercial cards with a company name.
Privacy-conscious customers using virtual card numbers that change per merchant.

Privacy and compliance considerations

Card data falls under PCI DSS; keep raw PANs in the cardholder data environment and use tokens elsewhere. Network rules govern how you can use and share transaction data and how disputes are evidenced (see Card Network Dispute Rules). Debit card disputes on consumer accounts also carry Reg E obligations (Regulation E and Unauthorized Transfers).

Mechanisms it helps detect

Card-Not-Present Fraud · Card Testing · Digital Wallet Provisioning Fraud · Chargeback and Friendly Fraud · Card-Linked Offer Abuse · Gift Card Fraud · Triangulation Fraud · Multi-Accounting

Funding Source Signals · Dispute and Return History · Velocity Signals · Device Reputation and Linkage · 3-D Secure and Card Verification · Negative Lists and Deny Lists · Playbook - Card Testing Members · Playbook - Chargeback Management Members

Sources and further reading

Checkout.com: AFT compliance dates: Visa and Mastercard AFT mandates and timelines.
NMI: Account Funding Transactions: AFT use cases, Visa Business Application Identifier, Mastercard recipient name.
Adyen: From AFT to payout: AFT/OCT structure and issuer scrutiny of funding transactions.
Qualpay: Visa Compelling Evidence 3.0: CE 3.0 effective April 2023; prior undisputed transaction requirements.
EMVCo: EMV 3-D Secure: data shared with issuers for risk-based authentication.