AVS and CVV Settings: Which Mismatches Your Store Should Decline
Set AVS mismatch settings and CVV rules that block card fraud without rejecting good customers. Learn what each code means and which to decline.
Photo: Pixabay
On this page 7 sections
Key takeaways
- AVS and CVV results usually come back alongside an issuer approval, and your gateway rules decide whether that approved order is kept or voided.
- Treat a CVV mismatch as a strong fraud signal. Treat a partial AVS match as a reason to review, not an automatic decline.
- Non-U.S. cards often can't be checked by AVS, so international orders need other signals, such as 3-D Secure.
- Match your decline rules to your risk level, then review flagged orders against a checklist before you ship.
Your gateway's AVS mismatch settings decide which card-not-present orders go through and which are stopped. They affect both your fraud losses and the number of good customers you turn away. Many online stores either leave these settings at the defaults or tighten them after one bad chargeback and then lose sales they never see. This guide explains how address and security-code checks work, what the common AVS codes mean, why an approved order can still "fail," and how to build decline rules that fit your store's risk level.
How AVS and CVV Checks Work on an Online Order
When a shopper checks out on your website, or your staff keys a phone order into a virtual terminal for card-not-present orders, two verification checks usually travel with the authorization request:
- AVS (Address Verification Service) compares the billing address the customer entered with the address the card issuer has on file. In most cases it checks only the numeric parts: the house or building number and the ZIP code.
- CVV (card verification value) checks the three- or four-digit security code printed on the card. Merchants are not allowed to store it after authorization, so a correct CVV suggests the person has the physical card or its full details.
The issuer then sends back three separate results:
- An approval or decline on the transaction itself
- An AVS response code
- A CVV response code
Many owners miss this point. The issuer can approve the charge and still report that the address or security code didn't match. Your gateway's filter settings decide what happens next. You can configure them to accept the order, hold it for review, or automatically void it.
These settings live in your payment gateway, not your shopping cart. If you aren't sure where your payment gateway handles verification rules, our guide to payment gateways vs. merchant accounts explains which system controls what.
AVS Codes Explained: Common Response Codes and What They Mean
AVS response codes are single letters. The exact letters and their definitions vary somewhat by card network and gateway, so check your gateway's documentation before you build rules. The codes below are widely used by U.S. gateways.
| Code | Typical meaning | What it suggests |
|---|---|---|
| Y | Street number and 5-digit ZIP match | Strong match |
| X | Street number and 9-digit ZIP match | Strong match |
| A | Street address matches, ZIP does not | Partial match |
| Z | 5-digit ZIP matches, street does not | Partial match |
| W | 9-digit ZIP matches, street does not | Partial match |
| N | Neither street nor ZIP matches | Full mismatch |
| U | Address information unavailable | Issuer couldn't check |
| R | Retry; system unavailable or timed out | Temporary issue |
| S | AVS not supported by issuer | Issuer couldn't check |
| G | Non-U.S. issuer does not participate | Common on international cards |
| E | AVS error or not allowed for this transaction type | Check your setup |
CVV results are simpler:
| Code | Typical meaning |
|---|---|
| M | Security code matches |
| N | Security code does not match |
| P | Not processed |
| S | Code should be on the card, but none was submitted |
| U | Issuer not certified or didn't provide a result |
What a Partial AVS Match Usually Means
A partial AVS match (A, Z or W) is the result most likely to catch legitimate buyers. Common innocent causes include:
- The customer moved recently, and the bank still has the old address, or the reverse.
- The customer typed "Suite 200" in the street line, and the number confused the comparison.
- The customer has a ZIP+4 on file but entered a different ZIP during checkout.
- Corporate and purchasing cards are billed to a headquarters address the employee doesn't know.
A partial match on its own doesn't mean the order is fraud. Combined with other warning signs, it deserves a closer look.
Why Authorized Orders Can Still Fail AVS
Because the issuer can approve a transaction before your gateway applies its filters, an order rejected for AVS or CVV often goes through this sequence:
- The issuer approves the charge and places an authorization hold on the customer's available credit.
- Your gateway sees the mismatch code and voids the transaction according to your settings.
- The customer gets an error message and tries again, sometimes several times.
Depending on the issuer, those voided authorizations can still show as pending on the customer's account for a while. A shopper who tried three times may think they were charged three times and call you or their bank. This is a common source of support tickets and occasional disputes from customers who did nothing wrong.
Ways to limit the damage:
- Show a clear checkout message such as "The billing address doesn't match your card. Please check it against your statement." Don't show a generic "card declined."
- Explain in your FAQ that a pending charge from a failed attempt is not a completed charge.
- Limit retries per session. This also helps defend against card testing attacks that hit your checkout, where bots cycle through stolen card numbers and addresses.
Issuers can also decline a transaction outright because of a CVV or AVS problem. That shows up as an issuer decline rather than a gateway filter result. Our guide to credit card decline codes and what to do about each covers that side.
Recommended AVS Mismatch Settings by Risk Level
No single rule set fits every store. A store selling low-cost digital downloads can accept more uncertainty than one shipping high-value electronics overnight. The table below is a starting point to adjust, not a standard.
| Result | Lower-risk store (low tickets, slow shipping, few disputes) | Medium-risk store | Higher-risk store (high tickets, resellable goods, fast shipping) |
|---|---|---|---|
| Y / X (full match) | Accept | Accept | Accept |
| A / Z / W (partial) | Accept | Accept, flag high-value orders for review | Hold for review |
| N (no match) | Hold for review | Decline | Decline |
| U / S / G (unavailable) | Accept | Review, especially international | Review or require 3-D Secure |
| R (retry) | Allow customer to retry | Allow customer to retry | Allow customer to retry |
| CVV N (mismatch) | Decline | Decline | Decline |
| CVV P / U (not processed) | Accept | Review | Review |
| CVV S (not submitted) | Fix your checkout | Fix your checkout | Fix your checkout |
When a CVV Mismatch Decline Makes Sense
For most stores, a CVV mismatch decline is the easiest rule to justify. Fraudsters who buy card numbers often don't have working security codes, and legitimate customers rarely mistype a three-digit code they're reading off the card. If a real customer does mistype it, they can usually fix it on the next attempt. Declining on CVV "N" stops a lot of fraud at little cost to good sales.
If you see CVV "S" codes, your checkout or virtual terminal probably isn't sending the code at all. Fix that before you adjust any rules.
Avoid Stacking Rules That Cancel Each Other
Owners sometimes switch on every filter in the gateway. That can decline an order for a single weak signal before anyone looks at it. A better approach:
- Decline only on strong signals, such as a CVV mismatch or a full AVS mismatch at medium or higher risk.
- Review combinations, such as a partial AVS match plus a different shipping address plus a high order value.
- Accept clean matches without manual review so your team's time goes to the orders that matter.
Revisit your settings each quarter. If your review queue is full of good orders, loosen the rules. If disputes are rising, tighten them. If you run a high-risk merchant account, confirm that your rules meet any conditions your acquiring bank set at approval. If you also sell on Amazon, our guide to the Amazon account level reserve and why your disbursement shrank covers how marketplace holds affect your payouts.
International Cards and AVS Limitations
The address verification service in ecommerce was built mainly around U.S. billing addresses. Many issuers outside the U.S. don't support it, or support it only partly. Some can check a postal code but not a street address, and many return "unavailable" or "not supported" codes such as G, S or U.
If your rules decline anything that isn't a full match, you will likely block most legitimate international buyers. For stores that sell abroad:
- Don't decline on AVS "unavailable" codes alone for non-U.S. cards.
- Rely more on CVV, device and IP checks, order velocity and shipping risk.
- Use authentication. 3-D Secure authentication for online payments puts a cardholder verification step from the issuer into checkout. For eligible authenticated transactions it can also shift fraud chargeback liability, which AVS alone does not. Our article on 3D Secure for online stores without lost sales explains how to use it selectively.
If cross-border sales are a growing part of your business, ask your provider about international payment processing options. Confirm current network rules and liability terms with them, because these change.
Reviewing Mismatches Before You Ship
A hold-for-review rule only works if someone actually reviews the order. Use this checklist on flagged orders before anything leaves your warehouse.
Order details - Is the order value unusual for your store? - Did the customer pick expedited shipping on a first purchase? - Are the quantities odd, such as several of the same high-value item?
Customer details - Do the email address, phone area code and billing ZIP point to the same region? - Is this a returning customer with clean order history? - Have several cards been tried for this order or address?
Shipping details - Is the shipping address a freight forwarder, a vacant lot or a known reshipper? - Does the billing city match the shipping city? A mismatch is often harmless, as with gifts, but adds to the overall risk.
Next step - Contact the customer by phone or email using the details on the order. A real customer will usually confirm quickly. A fraudster often won't respond. - If you cancel, void or refund the authorization promptly so the hold clears as soon as the issuer allows.
Illustrative example: A home-goods store receives a large order with AVS code Z (ZIP matches, street doesn't), CVV match, and a shipping address in the same city as the billing ZIP. A quick email shows the customer moved last month. The store ships. A second order on the same day shows AVS N, a CVV mismatch on the first attempt, and overnight shipping to a different state. The store cancels it.
Keep records of every verification result and review decision. If a disputed order does ship, AVS and CVV results, delivery confirmation and customer communications can support your response. See evidence that wins 'Item Not Received' chargebacks for what to collect.
Next Steps for Your Store
- Log in to your gateway and write down your current AVS and CVV settings.
- Make sure your checkout and virtual terminal send the CVV and the full billing address.
- Pick the risk column in the table above that best fits your products and dispute history, and adjust from there.
- Rewrite your checkout error messages so customers can fix typos themselves.
- Add 3-D Secure for international or high-value orders if you haven't already.
If you want help reviewing your gateway configuration, MannyPay supports online and ecommerce payment acceptance through gateways including Authorize.net and NMI. You can request a free quote, and a MannyPay specialist will respond within one business day.
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
