What Is AVS in Credit Card Processing?

Address verification service (AVS) is an essential fraud prevention tool that matches the customer’s billing address against the address on file with the issuing bank. It is used by e-commerce merchants who accept credit or debit card transactions from customers in the United Kingdom, Canada, and the United States. All four major credit card companies (Visa, MasterCard, Discover, and American Express) participate in the address verification system.

For e-commerce merchants, there are several important things to know about AVS in credit card processing:

• AVS checks the street address and postal code in a customer’s billing address against the address they have on file with their bank.
• After the check is performed, an AVS response code is returned to the merchant, who makes the final decision about whether or not to approve the transaction.
• Along with card verification value (CVV), AVS is the most used fraud prevention tool in e-commerce.
• AVS does not work for all countries.
• AVS will not stop fraud if the fraudster has the victim’s address.
• AVS authentication should be used in conjunction with other fraud detection mechanisms, such as reverse lookups and IP address verification, as part of a comprehensive fraud prevention system.

When and Why AVS Is Used

AVS is mainly used in card-not-present scenarios to reduce fraud and prevent chargebacks. It adds an extra layer of protection, replacing security measures that would be present with a physical card (either chip-and-pin or contactless).

AVS is used in:

• Online Shopping, Phone, and Email Orders: When cards are not physically present, e-commerce and mail-order businesses use AVS as an extra layer of fraud protection.
• Subscriptions and Recurring Payments: Gyms, SaaS tools, and streaming services will often use AVS to prevent future chargebacks.
• Risk Classification: AVS helps businesses establish more robust risk protocols by enabling transactions to be classified as low- or high-risk.

Please note: Although it is primarily used in the US, the UK, and Canada, some other countries, including New Zealand and Australia, also support AVS.

How the Address Verification System Works

When a merchant uses the address verification service, their payment gateway transmits an AVS request for every debit or credit card transaction.

The process works as follows:

Step	Who	Action
1	Customer	Makes a purchase.
2	Payment Gateway	Sends a request to the customer’s credit card company.
3	Credit Card Company	Passes the request to the customer’s card-issuing bank.
4	Issuing Bank	Checks the billing address information supplied against the cardholder’s billing address on file with the bank.
5	Issuing Bank	Returns an AVS code indicating the extent to which the supplied and registered addresses match.
6	Merchant	Receives the associated AVS response code and decides whether to decline or approve the transaction, or request additional information from the customer.

This entire process takes only a few seconds and is invisible to the customer. The customer will only see the result of the transaction, for example: “approved,” “declined,” “more information required,” “we’re having trouble verifying your card,” or another similar message that you would like to display.

It’s important to understand that the address verification service only matches the street address and postal code, not the city or town name. For example, for the address “7 Example Street, Example City, 12345, Country,” the address verification system will check whether “7 Example Street” and the postal code “12345” match the address on file.

AVS Response Codes (A-Z)

Depending on the customer’s credit card brand, several possible AVS codes may be returned to the merchant, ranging from A to Z. The most common codes are similar across all four major brands (Visa, MasterCard, Discover, or American Express). Codes supplied by the other card companies may be different from those shown here.

Common AVS codes

• N – neither the postal code nor the address match
• Y – address & postal code match (American Express), address matches (Discover), address & 5-digit postal code match (MasterCard), address & 5-digit or 9-digit postal code match (Visa)
• U – information not available (Visa, Discover, and American Express), system unavailable, retry (MasterCard)
• G – address not verified for international transaction (Visa)

Many merchants also categorise AVS codes into a “Spotlight” structure.

Green	Full Match – Low Risk	Automatic approval
Yellow	Partial Match – Medium Risk	Manual check
Red	No Match or Error – High Risk	Declined

How to Handle an AVS Mismatch

In the case of an AVS mismatch, the merchant can either:

1. Decline the transaction
2. Contact the customer using their email address or phone number to see whether they intended to place an order or were the victim of credit card fraud

Even in the case of a mismatch, the transaction appears on the customer’s bank balance as “pending” until the merchant makes a decision or until the time limit set by the merchant or the bank for pending charges to expire (up to 3-7 business days).

What Does AVS Rejected Mean?

AVS Rejected occurs when the configuration on your payment gateway automatically rejects all transactions that do not match the “full match” criteria. This reduces fraud and is recommended for high-risk items, but can lead to false declines.

Limitations of AVS: When AVS Is Useful and When It Is Not

AVS helps a great deal with certain transactions. However, it isn’t a guaranteed fraud prevention solution for e-commerce.

When AVS Works

A British customer’s credit card number is stolen in a data breach, and a third party attempts to use it to place an order. In this case, AVS will block the fraudulent transaction because the fraudster doesn’t have the address.

Or

A Canadian customer’s card is dropped in a store by accident, and a bystander picks it up. Even though the card is present and the bystander has the CVV, AVS will still be effective because the bystander doesn’t have their address.

When AVS Doesn’t Work

An American customer’s wallet is stolen while backpacking abroad, and the thief uses the customer’s credit card and driver’s license to make fraudulent purchases. In this case, AVS will not help, as the thief already has the victim’s address. (However, an IP verification check could help the merchant discover the fraud.)

Or

A hacker gains access to a customer’s computer through Account Takeover (ATO). The computer has “autofill” enabled, and the card and address information are automatically input at the time of purchase.

The AVS Trap: False Positives

It’s possible that AVS could block legitimate transactions by mistake. This often happens when a customer has moved to a new address and has not yet notified their bank. It can also happen when a customer is shopping on their phone and can’t remember their postal code, or when they simply make a typo while entering their information.

Keeping these scenarios in mind, merchants should have a backup plan for handling certain AVS response codes. A quick call or email to the customer should quickly clear up an accidental mismatch. For customers in countries that don’t support AVS, it’s possible to use other verification methods, like 3D Secure authentication.

AVS in Europe

Online commerce in Europe is highly regulated. Strong security checks are mandatory and fall under the Revised Payments Services Directive (PSD2/3). Under the PSD2 EU directive, European merchants are required to implement Strong Customer Authentication (SCA) for online transactions in the European Economic Area.

As a result, AVS plays only a supporting role in most European transactions, if at all.

Best Practices for Using AVS to Protect Your Business

Using AVS correctly requires more than checking that addresses match before approving a transaction. Follow these additional tips to make AVS more effective:

• Use a multi-layered approach: Do not use AVS as your sole fraud-prevention; combine it at least with CVV.
• Manage your mismatches manually: Do not configure automatic declines for “partial matches”; this can lead to false positives. If the transaction triggers a mismatch, follow these steps: (1) check the CVV, (2) verify the shipping location, and (3) call the customer.
• Comply with European standards: Use 3D Secure 2.0 and strong customer authentication (SCA) to strengthen security and avoid fees and liability.
• Leverage AI-powered tools: Automation and AI add an extra layer of security, providing a more precise risk score, adaptive automated responses, and the ability to identify automated bot attacks and sophisticated threats such as carding.

AVS FAQs

Does AVS cost extra?

AVS is usually included as a standard feature by most payment processors. Some processors may charge a small fee (usually a few cents) per request.

Can I ship to a different address than the AVS address?

Yes, but keep in mind this increases your risk. If the billing address matches, but the shipping address is a freight forwarder, be even more cautious.

Can I accept a transaction if AVS fails?

Yes, but this significantly increases the risk of chargeback and fraud. Most payment gateways will allow a transaction to be “forced” through, but you may lose certain merchant protections and bear full liability.

AVS Is Only Part of a Comprehensive Fraud Prevention Strategy

AVS for credit card processing is a vital security tool for e-commerce merchants who serve customers in countries that support AVS. However, it’s not a guaranteed fraud prevention solution and should not be your only protection.

For round-the-clock fraud protection to help you avoid fraudulent transactions and chargebacks, you need a credit card processor with merchant services that include advanced, adjustable fraud scrubbing, chargeback mitigation tools, and 24/7 customer support.

By combining AVS verification with these advanced merchant services, you will make your business more resilient and secure, supporting long-term growth.

Published: June 21, 2022
Last updated: March 4, 2026