Two small fields travel with every card not present authorisation, and both come back with a one letter answer. AVS compares the billing address the shopper typed against the address the bank holds. CVV compares the code on the card. Neither can stop a determined fraudster, and neither should be ignored, because how you treat the answers decides both your fraud rate and your interchange.
What AVS actually checks
Only two things: the numeric part of the street address, and the postcode. Not the city, not the state, not the name. In the United States it checks the house number and the ZIP. Outside the United States, support is patchy: many European and Asian issuers return no useful answer at all, which is the single most important fact about AVS for an international store.
The response codes worth knowing
| Code | Meaning | Usual treatment |
|---|---|---|
| Y | Address and postcode both match | Accept |
| X or D | Full match including nine digit ZIP | Accept |
| A | Address matches, postcode does not | Accept for low value, review for high |
| Z or W | Postcode matches, address does not | Review |
| N | Neither matches | Decline or hold for review |
| U, G, S | Issuer does not support AVS, or is foreign | Do not decline on this alone |
| R | System unavailable, retry | Do not decline |
The mistake that costs real money is declining U and G. Those are not failures, they are silence. Decline them and you turn away most international cards.
CVV results
The answers are simpler. M means matched. N means did not match. P means not processed. S means the merchant indicated the card has no code. U means the issuer is not certified.
An N on CVV is a much stronger fraud signal than an N on AVS, because a physical card thief has the code and a data thief usually does not. Most stores decline outright on CVV N, and that is a defensible default.
The rule that catches people out: you may not store the CVV after authorisation, ever, not even encrypted. That is why a saved card charged later has no CVV result at all, and why you should not use a missing CVV as a fraud signal on repeat billing.
The interchange angle
Sending address data is not only a fraud control. On card not present transactions the networks require AVS data for the transaction to qualify for the better interchange categories. Omit it and the sale downgrades, silently, on every order. For a store doing 40,000 a month that can be several hundred pounds a year for two fields you already collect at checkout.
Building a policy that does not punish good customers
The useful mental model is a score, not a gate. Combine the AVS letter, the CVV letter, the order value and one or two other signals, then decide.
- CVV N: decline, whatever else is true.
- AVS N with a domestic card and a high value: hold for review, do not auto decline. Genuine customers move house and forget.
- AVS U or G: ignore the AVS result and lean on other signals. This is the normal answer for most non US cards.
- AVS Z with a low value physical goods order: accept, and let the address mismatch show on the pick list.
- Billing and shipping in different countries plus AVS N: review every time.
What AVS will never catch
Any fraudster with the full card record has the billing address, so account takeover and stolen data both sail through. AVS catches the lazy end of the market. For everything else you need velocity limits, device signals, and a hold on the orders whose profile does not fit your normal customer. Our fraud rules page lists the checks worth turning on first.
A short checklist
- Send AVS and CVV on every card not present authorisation, without exception.
- Decline on CVV N.
- Never decline on AVS U, G, S or R.
- Review, do not decline, on AVS N above your average order value.
- Log both letters against the order so a dispute can be answered later.
- Recheck your rules once a quarter against what actually charged back.