Bank Card Verification Webhooks

When a bank card verification reaches a verdict, a result notification is sent to your endpoint with the event type BANK_CARD_VERIFICATION_COMPLETED. There is no Partner API endpoint for retrieving a standalone session, so this is the only way to receive the result programmatically — configure a webhook.

Where It’s Sent

The destination is the webhook URL configured on your account’s Bank Card Verification notification. Set it up under Settings → System Notifications. If the notification is configured with a signing key, the body is signed so you can verify authenticity — see Callback Signing.

Payload

For the full payload schema and every field’s type, see the API Reference page for this webhook.

Only a full match counts as a success.

`status`	Meaning
`MATCH`	Every requested check passed.
`NO_MATCH`	At least one check failed. `noMatchReason` says which.
`NOT_COMPARED`	No comparison was reached — the card data could not be established.

When status is NO_MATCH, noMatchReason carries the cause:

`noMatchReason`	Meaning
`NAME_MISMATCH`	A cardholder name was read, but it does not match `expectedName`.
`NUMBER_MISMATCH`	The card’s last four digits do not match the `expectedLastFour` you supplied.
`NAME_NOT_FOUND`	No cardholder name could be read from the card.
`NUMBER_NOT_FOUND`	No card number could be read from the card.
`LIVENESS_FAILED`	The capture was not a genuine physical card — for example a photo of a screen, or a printed copy.

nameMatch and lastFourMatch report the two component checks individually. lastFourMatch is null when you did not supply an expectedLastFour, since nothing was compared.

Only firstSix, lastFour and expiryDate are ever returned. The full card number is never sent, and the CVV is never captured at any point. Card capture and image processing run in a dedicated environment certified to PCI-DSS v4.0.1, and no card imagery is retained once processing completes.

The verdict is final. There is no manual review step for a bank card check, and a verdict that has been reached is never overwritten.

Standalone vs. KYC-Linked

The same card check serves two entry points, and they report differently:

Standalone — a session created through Create a Bank Card Session delivers its own BANK_CARD_VERIFICATION_COMPLETED notification, carrying the payload above.
Inside a KYC session — the result instead arrives as a nested bankCardVerification object on the identity verification webhook, with the same fields. A NO_MATCH there marks the verification Suspected for review rather than denying it — see Suspected Status.

Idempotency

Delivery may be retried, so handle notifications idempotently, keyed on id.

Start Here

ID Verification (KYC)

Business Verification (KYB)

AML Screening

Face Authentication

Age Estimation