AVS Vs CVV: How Address And Card Verification Differ And Work Together

AVS Address Verification Service, a payment fraud-control check comparing submitted billing address information with issuer records.

AVS and CVV are complementary fraud-control checks used in card-not-present transactions. While AVS compares billing address elements (street number and postal code) to issuer records, CVV verifies that the customer has access to the physical card by checking the card verification value printed on the card. Together they create a stronger fraud signal than either alone: AVS establishes that the billing address aligns with the issuer’s file, and CVV confirms possession of the card number and the printed security code.

Core Differences

• Data Checked: AVS checks address numbers and postal code; CVV checks the three- or four-digit security code on the card.
• Source: AVS response comes from the issuing bank via the network; CVV is validated during authorization but is not stored under PCI requirements.
• Purpose: AVS detects billing-address mismatch; CVV detects lack of physical card access or stolen card data.

Why Using Both Is Best Practice

Relying on one check leads to blind spots. An attacker with only card data might not know the CVV or billing address; one who obtained an address through data breaches might have a matching address but not the CVV. Using AVS and CVV together reduces false negatives—cases where fraud slips through—and reduces chargeback risk by building documented, layered defenses for dispute investigations.

How Results Are Interpreted

A strong acceptance pattern is AVS full-match plus CVV match—these transactions are low risk. Common ambiguous patterns include an AVS full-match with CVV mismatch (could be a mistyped CVV or attempted fraud) or CVV match with AVS partial/no match (possible legitimate cardholder using different billing format or gift card). Merchants should create policy rules that specify actions for each combined result set (accept, review, decline).

Operational Considerations

• PCI Constraints: CVV must not be stored after authorization; AVS data is typically stored as part of transaction metadata where permitted.
• International Cards: AVS support varies by country; CVV is widely supported but card issuance rules differ—use regional rulesets.
• Customer Experience: Excessive declines for AVS mismatches cause friction. Offer clear guidance in checkout (billing vs shipping address, suite numbers) to reduce false declines.

Example Risk Rules Combining AVS And CVV

Effective rule design balances fraud prevention and conversion:

• High Confidence: AVS = full match AND CVV = match → auto-approve.
• Medium Risk: AVS = partial match AND CVV = match → hold for manual review or require secondary authentication.
• High Risk: AVS = no match AND CVV = mismatch → decline automatically.

Handling False Positives

False positives occur when legitimate transactions fail one of the checks. To reduce these, normalize addresses, instruct customers to enter the billing address exactly as on their card statement, and provide a quick verification step (one-click callback or OTP) for ambiguous cases rather than an outright decline. Logging and auditing combined AVS/CVV results helps refine rules over time.

When To Relax AVS Or CVV Requirements

Some businesses—subscription services, marketplaces, or international merchants—may need to relax AVS or CVV hard declines to protect conversion. In such cases, consider adaptive controls: allow transactions with weaker AVS/CVV results but compensate with stronger behavioral signals, velocity checks, or step-up authentication for high-value orders.

In short, the AVS Address Verification Service, a payment fraud-control check comparing submitted billing address information with issuer records, works best when paired with CVV checks and other fraud signals. Combining both reduces fraud risk while allowing merchants to tune rules for customer experience and regional differences.