AVS and CVV Mismatch: Should You Accept the Transaction?
Got an AVS mismatch or CVV mismatch? Decode the response codes and decide when to ship or hold the order without turning away good customers.
Photo: Pixabay
On this page 7 sections
Key takeaways
- An issuer approval with an AVS mismatch is still an approval. You decide whether to ship, so set your rules before the order arrives.
- Treat a failed security code as a decline. Approve partial address matches on ordinary orders.
- Your break-even fraud rate is margin divided by margin plus fraud loss. Goods with thin margins that resell easily need much stricter lines.
- Matching codes won't win a fraud dispute. Evidence that ties the order to the cardholder will help, and successful 3-D Secure authentication moves fraud liability to the issuer, with exceptions.
An AVS mismatch or CVV mismatch doesn't stop a sale by itself. If the issuing bank approved the authorization, the card is open and the funds are on hold, and you decide whether to ship or void. Start with the security code. When it fails, decline. When only part of the address fails on an ordinary order, approve. A full address mismatch on an expensive or easily resold order goes to manual review.
Both kinds of mistake cost money. Ship to a fraudster and you lose the goods plus a chargeback fee. Turn away a real customer whose ZIP code changed last month and you lose the margin, along with that customer's next order.
How Address Verification Service and CVV Checks Work
An online checkout or a virtual terminal for phone and mail orders sends two extra pieces of data with an authorization request when you set it up to.
The first is the billing address. The address verification service (AVS) asks the card issuer to compare what the customer typed with the address on file, and the issuer returns a one-letter result. The standard U.S. comparison looks only at the numbers, which are the street number and the ZIP code. A misspelled street name passes. A wrong digit fails.
The second is the security code printed on the card. Each network has its own name for it. This article calls it CVV, as merchants generally do.
Two parts of this design catch merchants out. First, the issuer makes the approval decision, and issuers weigh the two checks differently. A failed security code is a common reason for a decline. A mismatched address is a common reason for an approval anyway, because address typos happen constantly. Second, your payment gateway lets you void a sale the issuer approved, using AVS and CVV filters you configure. Ask your provider whether that void also releases the hold on the customer's card. If it doesn't, the customer sees a pending charge for days, and you get an angry email about an order you canceled.
AVS checks the billing address only. It tells you nothing about where you're shipping.
Repeat sales have one more limit. Merchants can't keep the security code on file after a sale is authorized. As a result, recurring and stored-card charges carry no CVV result unless you ask the customer to re-enter the code at checkout.
Common AVS Response Codes Decoded
The letters below are the set U.S. gateways commonly display. Gateways relabel some of them and add their own codes for errors and for sales where AVS wasn't requested. Check your gateway's documentation before you build filters on these letters.
| Code | Street number | ZIP code | What it means |
|---|---|---|---|
| Y | Match | Match (standard ZIP) | Full match |
| X | Match | Match (extended ZIP) | Full match |
| A | Match | No match | Partial: ZIP is wrong |
| Z | No match | Match (standard ZIP) | Partial: street is wrong |
| W | No match | Match (extended ZIP) | Partial: street is wrong |
| N | No match | No match | Full mismatch |
| U | Not checked | Not checked | Issuer couldn't check the address |
| R | Not checked | Not checked | Issuer system unavailable; retry |
| S | Not checked | Not checked | Issuer doesn't support AVS |
| G | Not checked | Not checked | Non-U.S. issuer outside AVS |
What a Partial AVS Match Usually Means
A partial AVS match means only the street number or only the ZIP code agreed, and the innocent explanations are everywhere. The customer moved and never updated the card. A house number got mistyped. A gift buyer put the recipient's address in the billing fields. A company card bills to headquarters while the buyer works from a branch office.
Keep both results in perspective. A full match proves less than it seems, because stolen card data is sold with the billing address attached. A partial match is weaker evidence of fraud than it looks, because people get their own addresses wrong all the time.
What a CVV Mismatch Tells You
CVV results come back as a separate code:
| Code | Meaning | What to do |
|---|---|---|
| M | Match | Proceed on other signals |
| N | No match | Decline and let the customer retry |
| P | Not processed | Judge on AVS and other signals |
| S | Code should be on the card, but none was sent | Fix the checkout or keying process |
| U | Issuer not set up for CVV checks | Judge on AVS and other signals |
A CVV mismatch is the stronger of the two signals. A real customer mistypes the code once in a while. Someone who has a card number but not the card fails the check every time, and a bare number is exactly what card-testing bots and buyers of stolen data have. Decline the sale and invite the customer to re-enter the code. If the same card keeps failing in a short window, block it.
On a keyed phone order, an S result means the code never reached the issuer, which points to staff skipping the field. Make the security code a required field in your virtual terminal and train staff to ask for it on every call. Network verification rules also change. Our explainer on Discover's new card verification rule for online sellers covers one recent example.
An AVS Mismatch Decision Matrix You Can Adapt
Treat this matrix as a starting point, then adjust the thresholds with the arithmetic in the next section.
| AVS result | CVV result | Ordinary order | High-value or easily resold order |
|---|---|---|---|
| Full match | Match | Approve | Approve; still check the ship-to address |
| Partial match | Match | Approve | Approve if shipping to billing; review if not |
| Full mismatch (N) | Match | Review | Review; decline if shipping elsewhere and the customer is unreachable |
| Not checked by issuer | Match | Approve or review on other signals | Review, or request 3-D Secure authentication |
| Retry (R) | Any | Retry once | Retry once, then review |
| Any | Mismatch | Decline; invite retry | Decline |
| Any | Not processed | Judge on AVS and other signals | Review |
You decide what counts as ordinary and what counts as high-value. The math below shows where that line belongs for your business.
Run the Numbers Before You Set the Lines
Approving an uncertain order pays off when the chance that it's fraud is below this break-even rate:
margin ÷ (margin + fraud loss)
Fraud loss here means your cost of goods plus any chargeback fee. On a fraud order, the sale amount is reversed and the merchandise is gone.
Here's an illustrative example built on round assumptions. A jeweler sells a loose diamond that cost four-fifths of its sale price, so the margin is one-fifth of the price. Assume the customer pays shipping, and leave out processing fees and the chargeback fee. Adding the fee would only push the threshold lower. On a fraud order the jeweler loses the stone's cost, so margin plus fraud loss equals the full sale price, and break-even is one-fifth. If more than one in five of those uncertain diamond orders turns out to be fraud, approving them loses money. One stolen stone wipes out the margin on four good sales.
Apply the same formula and assumptions to a product that costs a quarter of its price, such as skincare with a healthy markup. The margin is three-quarters of the price and the fraud loss is one-quarter, so break-even is three in four. That seller can approve far more partial matches than the jeweler.
Two costs push real thresholds tighter. Card networks run monitoring programs that penalize merchants whose dispute or fraud ratios climb too high, so even break-even fraud carries a price. A good customer you decline costs you more than one sale's margin if they never come back.
The fraud probability should come from your own history. Pull last year's fraud chargebacks and note the AVS and CVV codes on each one. Then compare that mix with the codes on all your orders over the same period. If partial matches show up in your disputes no more often than in your sales, they aren't telling you anything.
What "Review" Should Actually Look Like
A review queue only helps if someone works it the same day. A workable checklist:
- Compare the IP address location with the billing and shipping addresses.
- Call the phone number on the order, and email the customer to confirm the billing address their bank has on file.
- Offer to ship to the billing address, or hold the order for pickup with an ID that matches the cardholder name.
- Re-run the payment with 3-D Secure authentication if your gateway supports it.
- Decline if you can't reach the customer before your shipping cutoff, and don't ship while the review is open.
For tools that automate parts of this, see ecommerce fraud prevention tools by stage of business.
Set Stricter or Looser Lines by Industry
Jewelry sellers belong at the strict end of the matrix. Fine jewelry and watches resell quickly, and as the example above shows, one bad order on a loose stone erases the margin on several good ones. The fraud pattern is familiar: goods headed to an address with no link to the billing address, rushed delivery, or a late request to change where the package goes. Jewelry and diamond merchants should review every full mismatch and require a signature on delivery. Refuse post-checkout address changes on any order you haven't verified.
B2B and wholesale sellers face the opposite problem. When a corporate or purchasing card bills to a headquarters or accounts payable office and the buyer sits in a branch, the order returns a partial match, or even an N, with nothing wrong. These orders come from repeat accounts and ship to known business addresses. A mismatch in that setting calls for a quick call to accounts payable rather than a decline. If buyers pay with single-use virtual cards, the workflow changes again. See accepting virtual card payments in B2B.
Professional services firms take retainers and invoice payments by phone, which makes them keyed card-not-present sales. Nothing ships, so resale fraud matters less than the overpayment scam. In that scam, a stranger pays a large retainer and then asks for the "extra" back by wire or to a different card. Refund only to the original card. A new client with an N result and an urgent refund story gets a decline.
General ecommerce stores with modest tickets do best leaning toward approval on partial matches, as the skincare example shows. Save review for N results above a dollar threshold you've calculated.
International Cards and Why AVS Often Fails
AVS was built around U.S. street numbers and ZIP codes. U.S. issuers support it widely. Support abroad is patchy, and a "not checked" code is a routine result on a foreign card. Even where AVS exists, postal codes that contain letters don't always compare cleanly. A filter that treats "no AVS result" as a mismatch will quietly decline foreign buyers who did nothing wrong.
On international orders, treat an unchecked address as missing data. Rely on the CVV result and on whether the IP location and shipping country line up. Authentication carries more weight here too. European shoppers are used to completing 3-D Secure authentication at checkout, so asking for it adds less friction there than it does with U.S. shoppers. If cross-border sales are a growing share of your volume, review your setup for international payment processing as well.
Why AVS and CVV Alone Won't Win a Fraud Chargeback
Matching AVS and CVV results show that you checked. They don't shift liability. When a cardholder tells their bank they didn't make a card-not-present purchase, the dispute lands on the merchant regardless of the codes. Knowing an address and a security code doesn't prove the cardholder placed the order.
The evidence that helps ties the order to the actual cardholder: delivery confirmation with a signature at the verified billing address, IP and device data that match earlier orders, account login history, and emails with the customer. At least one network's dispute rules also let merchants answer certain fraud disputes with records of earlier, undisputed purchases by the same customer that share identifiers such as device or IP address. The requirements are specific, so ask your processor whether your records qualify. Our guide to writing a chargeback rebuttal letter covers how to package that evidence.
3-D Secure is the tool that shifts fraud liability. When authentication succeeds, network rules move fraud-coded chargebacks to the issuer, with exceptions that differ by network. 3-D Secure 2 explained walks through when the extra step is worth it.
This week, open your gateway's AVS and CVV filter settings and write down what each one does. Confirm whether a filtered void releases the customer's hold. Then tag last year's fraud chargebacks with their codes so your matrix rests on your own numbers. If you'd like a specialist to look over your gateway setup, request a free quote from MannyPay.
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
