How Does Address Verification Service (AVS) Work?

The Address Verification Service, or AVS, works by taking the billing address you type at checkout, sending it through the card networks to the bank that issued your card, and asking that bank whether the numeric part of the address and the ZIP code match what it has on file. The bank answers with a single-letter code, and the merchant’s system uses that code to approve the charge, send it to review, or decline it. The whole exchange finishes in about two seconds.

AVS runs on card-not-present transactions: online orders, phone orders, and anywhere else a cashier cannot look at the card. It is a fraud filter, not a payment step you interact with directly.

The Round Trip Behind a Checkout

When you submit an online order, the merchant’s checkout page collects your card number, billing address, and ZIP code together. Its payment software packages those details into an authorization request and hands them to a payment gateway or processor. The processor encrypts and forwards the request through the relevant card network — Visa, Mastercard, American Express, or Discover — to the bank that issued your card.

That issuing bank pulls up the billing address it has on file for your account and runs the comparison. It generates a one-character response code summarizing the result, then sends the code back down the same chain: network to processor to merchant. From your side, checkout barely pauses.

The merchant’s system reads the code and applies whatever rules the business has configured. A clean match usually lets the order proceed on its own. A mismatch may trigger a decline, a manual review, or a request for more information, depending on how the merchant has tuned its fraud filters.

What AVS Actually Compares

AVS does not read your address word by word. It looks at two things: the numeric portion of the street address (the house or building number) and the ZIP code.¹ If your billing address is 456 Oak Avenue, the system pulls out “456” and your five-digit ZIP and checks those against the issuer’s records. Street names, apartment letters, and city names are generally ignored.

That means “Avenue” versus “Ave” will not break the match, but the wrong house number or the wrong ZIP will. If you supply the full nine-digit ZIP+4 and both it and the street number match, many processors return a stronger “exact match” code than a five-digit match would produce.²

One thing AVS on Visa and Mastercard does not check is the cardholder’s name. American Express and Discover include some name-matching codes, but name verification is not universal.

What the Response Code Tells the Merchant

The single letter the issuing bank sends back falls into a few practical buckets. A full match on street number and five-digit ZIP is the most common approval signal. A ZIP+4 exact match is a stronger version of the same result. Partial matches — the street number is right but the ZIP is wrong, or vice versa — sit in the middle. A “no match” says neither piece lined up, and many merchants decline those automatically. Separate codes cover situations where the check could not run at all: the issuing bank does not support AVS, the system was temporarily unavailable, or the card was issued outside the U.S.

Card networks each define their own code sets, though the domestic codes overlap heavily across Visa, Mastercard, Discover, and American Express.³

International Transactions

AVS was built around U.S. address formats, and support outside the country is thin. When a foreign-issued card is used, the network returns a separate set of international response codes rather than the domestic ones, and many non-U.S. banks do not participate in AVS at all.² Merchants that sell globally see a large share of foreign orders come back as “unavailable” or “not verified.”⁴ Automatically declining every one of those would block real customers, so businesses with meaningful international volume lean harder on CVV2 and other fraud signals for those charges.

How the Result Shapes the Decision

Most payment gateways let merchants set automated rules that accept or reject transactions based on the returned code. A common default rejects any code that indicates no match or an inability to verify, blocking those orders before the merchant ever sees them.⁵ Merchants can loosen those defaults if they want.

At a minimum, fraud specialists generally advise rejecting a straight “no match.” Partial matches often go to a manual review queue instead of an automatic decline, so a person can look at the order alongside other signals before deciding.⁵

AVS also affects what the merchant pays to process the sale. Card networks set interchange fees partly on the quality of the data submitted with a transaction. Visa may downgrade a card-not-present charge to a higher interchange tier if the merchant did not submit AVS data or the ZIP did not match. That adds cost on every affected sale, which is one reason merchants care about accurate billing addresses even beyond fraud.

If a charge is later disputed as unauthorized, the AVS result becomes evidence. A full match helps the merchant’s case; processing a sale despite a clear mismatch weakens it. Under the Truth in Lending Act, a cardholder’s liability for unauthorized credit card charges is capped at $50, and many issuers waive even that.⁶ The financial loss from card-not-present fraud almost always lands on the merchant, not on you.

Why AVS Alone Isn’t Enough

AVS has real blind spots, and understanding them explains both why a correct address can still be declined and why a stolen card can still slip through.

Stolen card data usually includes the billing address. A fraudster who bought both from a data breach can pass AVS without difficulty.¹
The name on the card is not checked on most networks, so someone using a stolen number with the real billing address still verifies.
Legitimate mismatches happen constantly. Customers who recently moved, use a P.O. box, ship to a different address than they bill to, or mistype a house number all trigger mismatches while being the real cardholder. A college student ordering to a campus address on a parent’s card is a routine example.
International coverage is limited, so a lot of foreign orders return “unavailable” rather than a real yes or no.

Because a matched address does not prove the person at checkout is holding the physical card, most merchants pair AVS with a CVV2 check — the three- or four-digit code printed on the card itself. Each check catches a different kind of fraud. A stolen number paired with a real address still fails CVV2 if the thief never had the card in hand. Visa’s Payment Account Validation service requires merchants to run at least one of the two, and running both together is standard practice.⁷

If your card gets declined at an online checkout and you know the number is good, the billing address is the first thing to check. Confirm the house number and ZIP match exactly what appears on your card statement, not the shipping address you use most often, and not an old address you moved from. That single fix resolves the majority of AVS-driven declines.

1
PCI Security Standards Council. Best Practices for Securing E-commerce
2
Visa Acceptance Support Center. Payments – AVS (Address Verification System) Results
3
PayPal Developer. AVS, CVV2, and Payment Advice Response Codes
4
Cybersource Developer Center. AVS Codes
5
Authorize.net Support Center. Understanding and Configuring the Address Verification Service (AVS)
6
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
7
Visa Developer. How to Use Payment Account Validation