Address verification service (AVS) is a card-network check that compares the numeric parts of the billing address entered at checkout with the address the card issuer holds for that card, and returns a single-letter response code describing how well they match. In payment security for E-commerce, AVS is one of the oldest and cheapest signals for spotting card-not-present fraud, because a thief who holds stolen card numbers often does not know the cardholder’s billing address.
AVS does not approve or decline a payment on its own. The issuer returns the result alongside the authorization decision, and the merchant decides what to do with it: accept, decline, void the authorization or pass the order to manual review. Its value therefore depends entirely on how the merchant interprets the codes and combines them with other signals.
How address verification service works in an authorization
AVS runs inside the normal authorization message. The shopper types a billing address, the merchant or its payment gateway includes the address data in the authorization request, and the request travels through the acquirer and the card network to the issuer. The issuer compares the submitted values with its records and returns an AVS result code together with the approval or decline.
In the classic United States implementation, only two elements are compared: the street number (the digits at the start of the street line) and the postal code. Street names, apartment details and city names are usually ignored, because free-text spelling differs too much between systems. This numeric-only comparison keeps the check simple but also limits what it can prove.
- The shopper enters card details and a billing address at checkout.
- The gateway formats the street number and postal code into the authorization request.
- The issuer compares both values with the cardholder record.
- The issuer returns an approval or decline plus an AVS response code.
- The merchant’s rules or fraud screening tool act on the code.
AVS response codes and what they mean
The response code is the practical output of AVS. Codes differ slightly between Visa, Mastercard, American Express and Discover, and gateways often translate them into their own labels, so merchants should read the gateway documentation rather than assume one universal list. The table shows commonly used codes in their typical domestic meaning.
| Code | Street number | Postal code | Typical interpretation |
|---|---|---|---|
| Y | Match | Match (5-digit) | Full match, lowest address risk |
| X | Match | Match (9-digit) | Full match with ZIP+4 |
| A | Match | No match | Partial match, often a recent move |
| Z | No match | Match | Partial match, often a typo in the street |
| N | No match | No match | No match, elevated risk |
| U | Unavailable | Unavailable | Issuer does not support AVS |
| R | Retry | Retry | System unavailable, retry later |
| G | Not checked | Not checked | Non-domestic issuer, AVS not supported |
Codes such as U, R and G carry no information about the shopper. Treating them as failures declines legitimate international customers, while treating them as passes ignores the fact that no verification happened at all.
Coverage and international limits
AVS has full support mainly in the United States, Canada and the United Kingdom, where issuers maintain structured address data and the networks define clear matching rules. In the United Kingdom the check uses the numeric parts of the address and the postcode. Many other markets return unsupported or unavailable codes for most cards, so AVS adds little value for cross-border orders.
Address formats also cause false mismatches. Alphanumeric postcodes, addresses without house numbers, rural route formats and transliterated characters can all produce partial results for honest cardholders. For this reason, merchants with significant international traffic usually weight AVS lightly and rely more on 3-D Secure and behavioral risk signals.
AVS compared with other card verification signals
AVS answers a narrow question: does the shopper know the billing address. It works best as one layer in a fraud screening stack, next to the CVV check, velocity checks and fraud risk scoring. The comparison shows where each signal is strong and where it is weak.
| Signal | What it verifies | Main strength | Main weakness |
|---|---|---|---|
| AVS | Billing street number and postal code | Cheap, built into authorization | Addresses are often in stolen data |
| CVV check | Three- or four-digit card security code | Not stored by compliant merchants | Captured by phishing and skimming |
| 3-D Secure | Cardholder authentication by the issuer | Can provide a liability shift | Adds friction and abandonment |
| Velocity check | Rate of attempts per card, device or IP | Stops card testing bursts | Needs tuning to avoid blocking regulars |
| Fraud risk scoring | Combined behavioral and data signals | Context-aware decisions | Opaque without good feedback data |
A crucial point is that AVS does not shift liability. A full AVS match does not protect the merchant from a fraud chargeback in the way a successful 3-D Secure authentication can. It is evidence of reasonable diligence, and some networks accept it as supporting evidence in chargeback representment for certain dispute types, but it is not a guarantee.
Designing AVS rules for an online store
Effective use of AVS means mapping each code to an action that fits the order risk. A store selling low-value digital goods can tolerate more partial matches than a store selling high-value electronics that can be resold quickly. Rules should also consider whether the shipping address differs from the billing address, because a full AVS match is less reassuring when goods ship elsewhere.
| AVS result | Order context | Recommended action | Reason |
|---|---|---|---|
| Full match | Shipping equals billing | Accept | Lowest address-related risk |
| Full match | New shipping address, high value | Review | Stolen data often includes the address |
| Postal code match only | Low value | Accept | Street typos are common |
| No match | Any value | Decline or review | Strong indicator of unknown cardholder |
| Unavailable or unsupported | International card | Use other signals | No verification took place |
When the merchant declines after an approved authorization, it should void or reverse the authorization promptly. Otherwise the funds remain held on the cardholder’s account for several days, which generates complaints and sometimes disputes even though no charge was captured.
Limitations and common mistakes
The biggest limitation is that billing addresses travel with stolen card data. Phishing kits, data breaches and infostealer malware routinely capture the full name, address and card number together, so a fraudster can pass AVS easily. AVS mainly stops low-effort fraud that uses bare card numbers.
- Declining every partial match rejects genuine customers who moved or mistyped, which costs more revenue than it saves.
- Ignoring unavailable codes treats unverified international orders as verified ones.
- Relying on AVS alone leaves the store open to fraudsters with complete identity data.
- Not reversing authorizations after an AVS-based decline creates holds that frustrate legitimate shoppers.
- Assuming identical codes across networks leads to misread results; mapping should follow the gateway’s documentation.
In plain words
When you pay online, the store sends the house number and postal code you typed to your bank. The bank answers with a short code that means roughly yes, partly, no, or cannot check. The store then decides whether the order looks safe.
It works like a doorman asking for your apartment number before letting you in. Most real residents know it, and a stranger who found a key usually does not. A thief who also stole your address will still pass, which is why stores combine it with other checks.
A real-world example
A United States retailer selling outdoor equipment noticed a rise in fraud chargebacks on orders above 400 dollars. Its review showed that most fraudulent orders came with an AVS code of N or used a shipping address in another state than the billing address. Domestic customers with partial matches, mostly people who had moved recently, almost never disputed their orders.
The team changed its rules: no-match orders above 150 dollars were declined and voided, partial matches were accepted when billing and shipping addresses agreed, and full matches with a new shipping address on high-value items went to manual review. Orders from international cards returning an unsupported code were sent through 3-D Secure instead. Within two quarters, fraud chargebacks fell noticeably while the approval rate for legitimate domestic shoppers stayed nearly unchanged.