Address verification service (AVS) explained for merchants

The address verification service, usually called AVS, is a fraud check that compares the billing address a customer gives you with the address the card issuer has on file. Visa describes it as a way for card-absent merchants to check the cardholder's billing address with the card issuer. You send the street address and postal code with the authorization request, and the issuer answers with a one-letter code.

If you searched for software that cleans up mailing addresses, that's a different product. Address validation tools check whether an address exists and is formatted correctly for shipping. AVS asks the bank a narrower question: does this address belong to the person who holds this card? This guide covers how that check works, what each response code means, where it works and where it doesn't, and how to set rules that stop fraud without turning away good customers. Rules are current as of October 2026.

How does the address verification service work?

AVS rides along with the authorization, the same way a CVV check does. Mastercard sums it up as checking the billing address and postal code entered by a customer against the one on file with the card issuer.

1. The customer types a billing address and ZIP or postal code at checkout, or reads them to you over the phone.
2. Your gateway sends them to your processor with the card number and amount.
3. The card issuer compares them with its records for that card.
4. The issuer returns an AVS result code alongside its approve or decline decision.
5. Your gateway applies your rules to the result: accept, hold for review, or void the authorization.

Step 4 is where merchants get caught out. The AVS result and the approval are separate answers. An issuer can approve a sale with an address that doesn't match, so a "no match" result only protects you if your gateway is set to act on it. Formatting differences between what the customer types and what the bank has on file, such as an apartment number written two different ways, can also produce a partial match for an honest buyer.

Why the check exists is easy to see in the fraud numbers. In the Federal Reserve's report on 2023 debit card transactions at issuers with $10 billion or more in assets, card-not-present fraud made up 54.3% of fraud losses, and merchants absorbed 65.1% of those card-not-present losses. When a remote sale turns out to be fraud, the loss usually lands on the merchant.

What do AVS response codes mean?

Each code tells you which parts of the address matched. Visa's developer documentation defines the main ones: Y means the street address and postal or ZIP code match, A means the address matches but the postal code doesn't, Z means the postal code matches but the street address doesn't (or wasn't sent), and U means no data came back from the issuer. Mastercard describes N as the code the major companies use when there is no match between the street address and the postcode.

Your gateway may show more codes than these, including separate codes for international cards, and some gateways translate them into their own wording. Ask yours for the full table and keep it next to your fraud settings.

Where does AVS work, and where doesn't it?

AVS works best for cards issued in the United States, Canada, and the United Kingdom. Outside those three countries, Chase's merchant guide notes that coverage is limited and many international issuers answer "not supported". That means a U result on a foreign card usually tells you nothing about fraud.

This matters a lot for cross-border sellers. Picture an outdoor gear shop in Vancouver that sells across Canada and the US and gets the occasional order from Australia or Germany. Domestic and US cards come back with useful Y, A, Z, and N results. The overseas orders mostly come back U. If the shop declines every result that isn't Y, it quietly shuts out its international customers.

The fix is to write separate rules for cards that can't be checked. Rely on the CVV result, the order's size, whether the shipping address is a known freight forwarder, and, for larger orders, 3-D Secure, which EMVCo describes as a tool to help prevent card-not-present fraud by checking the buyer with the card issuer.

One small thing trips up sellers who take Canadian orders: postal codes. A Canadian postal code mixes letters and numbers in the pattern A1A 1A1, so a checkout field built only for five-digit US ZIP codes either rejects it or mangles it, and the AVS result suffers. Make sure your form accepts letters and a space, and test it with a Canadian address before you assume a run of Z results means fraud.

The same rules apply in both countries we serve, so the guidance here works across the United States and across Canada.

How should you set AVS rules without declining good customers?

Set rules by risk, not by code alone. A partial match on a $15 digital download and a partial match on a $1,200 laptop shipped overnight to a new address are different problems, and your rules should treat them differently.

Here's the math behind that caution, with made-up numbers. Say an online store in Portland runs 2,000 orders a month at a $75 average, and 4% of them come back A or Z. That's 80 orders, or $6,000 in sales, each month. If 1 in 10 of those is fraud, auto-declining all 80 stops 8 bad orders and turns away 72 good customers worth $5,400. A review queue keeps most of that revenue and still catches the fraud.

Run your own version before you change a setting. If your gateway can export a month of orders with their AVS and CVV results, an hour in a spreadsheet tells you how many partial matches you get and how many later turned into chargebacks.

A quick setup checklist

1. Ask your gateway for its full list of AVS codes and what each one means in its dashboard.
2. Collect the full billing street address and postal code on every online and phone order.
3. Set default actions per code, using the table above as a starting point.
4. Add separate rules for cards issued outside the US, Canada, and the UK.
5. Pair AVS with CVV checks and velocity limits, and decide which orders get a manual look.
6. Review a month of results and chargebacks, then loosen or tighten one rule at a time.

Does AVS protect you from chargebacks?

Only in specific cases. A Y match doesn't stop a cardholder from disputing a sale, because a criminal who stole a card number may also have the billing address. But Visa's rules do give AVS results weight when you answer a fraud dispute.

• Visa's dispute management guidelines let your acquirer respond to a fraud dispute when you got an AVS Y match, the billing and shipping addresses are the same, and you can show proof of the shipping address and signed proof of delivery.
• Visa's acceptance guide says that if you ran AVS and the issuer answered U, you have a right to represent the dispute.

That first condition is a good reason to ship high-value orders only to AVS-matched billing addresses, with signature confirmation. It also explains why gift orders shipped to a different address carry more risk: they fall outside it. For the full dispute process, see how a chargeback works, and for prevention, our guide on how to prevent chargebacks.

How do AVS, CVV, and 3-D Secure fit together?

Each check answers a different question, so they work best together.

Turn on AVS and CVV for every online and phone sale, since they add almost no friction and stop the laziest fraud. Add 3-D Secure and manual review where the order size justifies the friction. Our CVV guide covers the security code side, and Clearo's online payments include fraud screening with AVS, CVV checks, and velocity rules.

Common AVS mistakes

Watch for these settings and habits:

• Collecting only the postal code at checkout, then wondering why every result is Z. Ask for the street address too.
• Treating approval as a pass. Check the AVS result separately, or set rules that act on it.
• Declining every partial match. That punishes customers who moved recently or typed "Apt" instead of "#".
• Applying US rules to international cards that can't be checked.
• Comparing AVS to the shipping address. AVS checks the billing address only; the shipping address is your call.
• Skipping AVS on phone orders. Key the billing address into your virtual terminal along with the card, since a phone sale is just as card-not-present as a web order.

When is strict AVS not worth it?

When the cost of the check is higher than the fraud it stops. If you sell low-priced digital goods to repeat customers, a hard decline on anything but Y will cost you more in lost sales than it saves. The same goes for B2B sellers whose buyers pay with corporate cards billed to a head office: the address the buyer types may not be the one the bank has.

On the other hand, if you ship electronics, designer goods, or gift cards, strict rules and a manual review queue pay for themselves. Our guides to card-not-present transactions and ecommerce merchant accounts cover the rest of the fraud picture for online sellers, and our ecommerce page covers setups for online stores.

Next step

If you don't know what your gateway does with an N or a U result today, that's the first thing to check. Send us a recent statement for a free statement review and we'll look at how your online and phone sales are priced, or contact us to set up AVS and CVV rules that fit your business.