A Guide to Address Verification Systems

Think of an Address Verification System (AVS) as a digital bouncer for your online store. When a customer makes a purchase, this system instantly checks the billing address they entered against the one their bank has on file. It's a simple, lightning-fast check that acts as a crucial first line of defense against fraud.

What Are Address Verification Systems

At its heart, an Address Verification System is a fraud prevention tool that cross-references the billing address from your checkout page with the official address held by the card-issuing bank. It’s not checking if the address exists on a map, but something far more specific: does the address provided match the cardholder’s bank records? This all happens in the background, in the split second between a customer clicking "buy" and the transaction getting approved.

For any ecommerce business, using an address verification system isn't just a good idea—it's essential. It's one of the most effective ways to stop chargebacks before they happen, cut down on shipping errors from customer typos, and keep your business in good standing with payment processors like Stripe, PayPal, and Shopify Payments.

Why AVS Is Critical for Online Merchants

Without AVS, you're essentially flying blind. You have no way of spotting one of the biggest red flags in card-not-present fraud. Think about it: a fraudster who gets their hands on a stolen credit card number probably won't know the real owner's billing address. AVS catches that mismatch and immediately signals that something is off.

This kind of protection is only getting more important. The global market for AVS is already valued at USD 11.86 billion in 2024 and is growing fast, partly because of rising fraud and partly because businesses need to cut down on operational waste. For some online stores, incorrect addresses contribute to as many as 30% of all failed deliveries. You can explore more data on the address verification service market to see just how significant this trend has become.

To help summarize, here’s a quick look at what AVS does and why it matters for your business.

AVS at a Glance: Key Functions and Merchant Benefits

AVS Function	Benefit for Merchants
Compares Billing Addresses	Instantly flags a primary indicator of potential card-not-present fraud.
Verifies Numeric Portions	Catches common typos in street numbers and ZIP codes to reduce shipping errors.
Generates Match Codes	Provides clear, actionable data to help you decide whether to approve or decline a transaction.
Automates the Check	Operates behind the scenes without adding friction to the customer's checkout experience.

Ultimately, an AVS is a gatekeeper. It won’t catch every sophisticated fraud attempt, but it reliably filters out the most common and straightforward ones, saving you from a world of headaches and financial loss.

The benefits go far beyond just stopping fraud. A well-implemented AVS helps you:

• Reduce Chargebacks: By catching fraudulent orders before they’re ever approved, you prevent them from turning into costly chargebacks down the line.
• Minimize Shipping Errors: AVS flags typos in ZIP codes and street numbers, ensuring packages go to the right place and saving you money on reshipment.
• Improve Authorization Rates: When banks see clean, verified transaction data, they’re more likely to approve the purchase, which means more successful sales for you.
• Protect Your Merchant Account: Payment processors keep a close eye on chargeback ratios. Using AVS is a fundamental step in keeping your ratio low and your account in good health.

How the AVS Process Works Step by Step

Ever wonder what happens in the split second after a customer hits "Complete Purchase"? A rapid-fire conversation takes place between your payment gateway and your customer's bank. Think of it as your system quickly asking the bank, "Hey, do the numbers in this billing address look familiar?" The bank's simple, one-letter reply can be the difference between a sale and a blocked transaction.

This whole exchange is completely invisible to the shopper but gives you a crucial piece of the puzzle. It all kicks off the moment your customer commits to the purchase. Your gateway—whether it's Stripe, PayPal, or another provider—instantly gets to work.

Step 1: The Gateway Sends the Numbers

First, your payment gateway grabs the billing address the customer typed in and strips out everything but the numbers. It zeroes in on the street number (like "123" in "123 Main St") and the ZIP code.

This is a critical detail many people miss. AVS doesn't care about street names, cities, or states. A typo like "Mane St" instead of "Main Street" won't cause a mismatch. It’s a system built for speed, focusing only on the numerical data points.

Once it has the numbers, the gateway bundles them securely with the credit card info and sends the package off to the card-issuing bank (think Chase, Bank of America, etc.) through the payment processing network.

Step 2: The Bank Checks Its Records

The issuing bank receives this data packet and performs a simple but vital check. Its system compares the street number and ZIP code from your gateway against the billing address it has on file for that card.

The bank isn’t trying to figure out if the address is real; it’s just doing a basic data comparison. Does what you sent match what it has? This entire check happens on the bank’s side, and the result is boiled down into a single response code.

Key Takeaway: The AVS check is performed by the customer's card-issuing bank, not your payment gateway. Your gateway is just the messenger, shuttling the request and bringing back the answer.

Step 3: The Response Code Comes Back

Finally, the bank sends its one-letter AVS response code back to your payment gateway. This code is a powerful signal that tells you how well the address information lined up. While the codes can have minor differences between card networks like Visa and Mastercard, the most important ones are universal.

Your payment gateway then uses this code, combined with your own custom rules, to make an instant decision: approve the sale, decline it, or flag it for you to look at more closely.

Here are the most common AVS response codes you'll see and what they mean:

• Y - Full Match: Perfect! Both the street number and the 5-digit ZIP code match the bank’s records. This is a very strong sign that the transaction is legitimate.
• A - Address Match Only: The street number matches, but the ZIP code doesn't. This could be a simple typo, but it’s worth being cautious.
• W - 9-Digit ZIP Match Only: The extended, 9-digit ZIP code matches, but the street address doesn't. This can happen if a customer uses a work address that the bank has on file.
• Z - 5-Digit ZIP Match Only: The 5-digit ZIP code matches, but the street number is wrong. This is a common result when a legitimate customer mistypes their house or apartment number.
• N - No Match: A major red flag. Neither the street number nor the ZIP code matches what the bank has. Many merchants set their systems to automatically decline these transactions.
• U - Unavailable: The bank couldn't perform the check. This often happens with international card issuers that don't participate in the AVS system. You'll need to rely on other fraud signals.
• S - Not Supported: The card issuer doesn't support AVS at all. Like the 'U' code, this means you have one less data point and must lean on other tools.

Getting familiar with these codes is the first step to making AVS work for you. By setting rules in your gateway based on these responses, you can automate much of your fraud prevention and make smarter, data-driven decisions that protect your bottom line.

Building Your Fraud Prevention Toolkit

Address Verification Systems (AVS) are a fantastic first line of defense against fraud, but let's be clear: they can't do the job alone. True security comes from layering your tools.

Think of it like securing your home. AVS is the strong lock on your front door—it's absolutely essential. But for real peace of mind, you also want an alarm system and maybe a security camera. By combining multiple verification methods, you create a security net that catches what a single tool might miss.

AVS in the Security Ecosystem

The most effective fraud prevention strategies I've seen always pair AVS with other powerful tools. Each one checks a different piece of the puzzle, and when you put them all together, you get a much clearer picture of whether a transaction is legitimate.

This isn't just a niche strategy; it's becoming the standard. The market for address verification software alone hit USD 6.65 billion in 2023 and is expected to climb to USD 12.1 billion by 2032, with North America making up 45% of that market. This explosive growth shows just how critical these systems have become for any serious merchant.

At its core, the AVS process is beautifully simple. A customer makes a purchase, your system pings their bank to check the address, and the bank sends back a response.

That simple "match" or "no match" response is your first, immediate signal of potential risk. Now, let’s see how this check fits in with the other tools in your kit.

AVS vs. Other Verification Tools

While AVS focuses squarely on the billing address, other tools look at different parts of the transaction. When you use them together, you're building a multi-point inspection that is much tougher for a fraudster to beat.

• Card Verification Value (CVV): This is the three or four-digit security code on the card. A CVV check is designed to prove that the person making the purchase physically has the card. A criminal who only has a stolen card number will almost always fail this test.

• 3D Secure (3DS): This is an extra authentication step that redirects the customer to their bank's website to enter a password or a one-time code sent to their phone. 3DS is a powerful way to confirm the actual cardholder is making the purchase, and in many cases, it shifts the liability for fraudulent chargebacks from you to the issuing bank.

• Device Fingerprinting: This technology quietly collects anonymous data about the user’s device—things like their operating system, browser, and IP address—to create a unique digital "fingerprint." It’s great at spotting suspicious patterns, like a single device being used to place multiple orders with different credit cards.

Key Insight: No single tool is a silver bullet. AVS can be unreliable with international cards, and CVV is useless if a thief has stolen the physical wallet. The real power comes from layering these tools so they cover each other's blind spots, creating a much stronger defense.

This idea of cross-verifying information isn't unique to e-commerce. You see similar risk mitigation tactics in other industries, too. For example, running a credit check for a tenant serves the same basic purpose in the rental world: verifying someone's identity and financial history to prevent problems down the line. By understanding how these tools work in concert, you can build a formidable security strategy that's right for your business.

Configuring AVS in Your Payment Gateway

Understanding the theory behind address verification is great, but the real test is putting it into practice. This is where you actually start protecting your revenue. Fortunately, major payment gateways like Stripe, PayPal, and Shopify Payments give you direct control over AVS settings.

The trick is finding those settings and tuning them correctly. It’s a balancing act. If your rules are too strict, you'll inevitably block legitimate customers who just made a typo, costing you sales and creating frustration. But if they're too loose, you’re essentially leaving the welcome mat out for fraudsters.

Setting AVS Rules in Stripe

Stripe probably offers the most detailed AVS controls out there, letting you build custom rules that fit your business's unique risk profile. You’ll find these options in your Stripe Dashboard by going to Settings > Radar > Rules.

Stripe comes with some basic protections enabled, like blocking payments if the CVC (CVV) check fails or if both the street and postal code checks come back as a mismatch. You can—and should—go a step further.

1. Block on Mismatch: A solid, foundational rule is to block any payment that fails both the street address and ZIP code checks. In Stripe's rule engine, this looks like: block if :avs_postal_code_check: = 'fail' and :avs_street_line1_check: = 'fail'. This rule specifically targets transactions that return an AVS response code of 'N' (No Match).

2. Review Partial Matches: Instead of an automatic decline, you can flag transactions with partial mismatches for manual review. For instance, a common typo is getting the ZIP code wrong but the street address right. You could create a rule to request 3d_secure if :avs_postal_code_check: = 'fail' and :avs_street_line1_check: = 'pass'. This introduces an extra security step without automatically killing the sale.

Stripe's rules can essentially function as a smart decision engine. For any merchant serious about fraud prevention, getting comfortable with these settings is a must. If you're just getting started on the platform, our guide to setting up your Stripe account covers initial configurations that pair well with these AVS rules. https://disputely.com/stripe-signup

Configuring AVS in PayPal and Shopify

While PayPal and Shopify Payments also have powerful AVS features, the controls are presented a bit differently. The core idea, however, is the same: you get to decide which level of address mismatch you're comfortable with.

For PayPal: AVS settings live inside your Account Settings under the "Payment Receiving Preferences" section. Here, you can tell PayPal how to handle transactions with different AVS results. You have the flexibility to accept payments with a partial match or when the AVS system is down, or you can opt for stricter rules that decline them.

For Shopify Payments: Shopify bakes its fraud prevention right into the checkout flow. From your Shopify admin, head to Settings > Payments. You can enable AVS here, and it will work alongside CVV checks. Shopify’s fraud analysis then uses the AVS outcome as a key data point to flag orders as low, medium, or high risk. A high-risk flag, which is often triggered by an AVS mismatch, is your cue to pause and investigate the order before fulfillment.

A complete fraud strategy isn't just about blocking bad actors. It's also about mastering how to collect payments from customers smoothly and safely by weaving different security checks together from the very beginning.

Finding Your AVS Sweet Spot

There's no single "best" AVS configuration that works for everyone. Your ideal setup really depends on your specific business, what you sell, and your personal tolerance for risk.

• For high-value goods: It’s wise to lean toward stricter rules. Blocking a transaction with any AVS mismatch might cause an occasional false decline, but it’s often worth it to prevent a major financial loss.
• For digital products or low-cost items: A more forgiving approach usually makes more sense. You might decide to accept partial matches (like when the ZIP is correct but the street isn't) to reduce friction for good customers.
• For international sales: Remember that AVS is most reliable in the US, UK, and Canada. If you rely too heavily on it for orders from other countries, you’ll see a lot of false declines. For these sales, give more weight to other signals like CVV matches and IP geolocation.

A good strategy is to start with moderately strict rules and then keep a close eye on your declined transactions. If you start seeing a trend of what look like legitimate customers being blocked, you can dial back your settings. Think of it as an ongoing process of fine-tuning to strike the perfect balance between tight security and a great customer experience.

Using AVS to Minimize Chargebacks

It’s easy to think of the Address Verification System (AVS) as a simple on/off switch for your sales. If the addresses match, approve. If not, decline. But sticking to that rigid mindset is a surefire way to leave money on the table and turn away good customers.

The real power of AVS isn't in blocking sales—it's in giving you the data to make smarter risk decisions. When you learn how to read the signals it sends, you can stop fraud in its tracks without accidentally rejecting legitimate orders. It’s all about moving beyond a simple "match" vs. "no match" mentality and looking at the shades of gray in between.

Interpreting Partial Mismatches

A partial AVS mismatch isn't a dead end; it's a prompt to dig a little deeper before making a call. Instead of an automatic rejection, you can use these signals to trigger a quick manual review or an extra security check.

Think about a common scenario: you get an order where the ZIP code matches but the street address doesn't (this usually returns AVS Code 'Z'). A fraudster? Maybe. But it’s far more likely to be a real customer who just made a typo, like typing "123 Main St" instead of "132 Main St." Declining that order instantly means a lost sale and a frustrated shopper who probably won't be back.

A much better strategy is to flag that order for a quick look. Your system can automatically hold it, giving you a moment to check other risk factors:

• Does the shipping address differ from the billing address?
• Is it an unusually high-value purchase?
• Is this a first-time customer?
• Does the IP address location make sense for the billing address?

If everything else checks out, you can confidently approve the order and capture the revenue. This smarter, more nuanced approach helps you save sales you would have otherwise lost to an overzealous security setting.

Creating Intelligent AVS Rules

The most effective AVS setups are built on custom rules that fit your business, your products, and your customer base. Default, one-size-fits-all settings are a starting point, but tailoring your rules is what truly balances tight security with a great customer experience.

Here are a few best practices for building smarter rules in your payment gateway:

1. Automate Declines for High-Risk Mismatches: You should almost always automatically block transactions that return a full "No Match" (Code 'N'). This is the clearest sign of a stolen card, and the risk of approving these sales just isn't worth it.

2. Flag Partial Matches for Review: Create rules that flag orders with partial mismatches. Good candidates for review are Code 'Z' (ZIP match, street mismatch) or Code 'A' (street match, ZIP mismatch). These orders can be sent to a review queue for your team to investigate. If you're on Shopify, you can learn more about how to place a fulfillment hold on Shopify orders to buy yourself time.

3. Use Order Value as a Factor: Make your rules even more intelligent by adding order value to the equation. For instance, you could automatically approve a $15 order with a partial mismatch but flag a $500 order with the same mismatch for a thorough manual review.

By treating AVS codes as data points rather than verdicts, you transform a simple security check into a dynamic part of your chargeback management plan. It becomes your first, most crucial step in identifying and neutralizing risk before a sale is even completed.

Acknowledging the Limitations

It's also critical to remember what AVS can't do. The system works best in the United States, the United Kingdom, and Canada, where banking and address standards are fairly consistent.

Once you start processing international orders, you'll find that many issuing banks don't fully support AVS. This results in "Unavailable" or "Not Supported" responses, leaving you in the dark. In these situations, you can't rely on address verification alone. Your fraud rules should automatically place more importance on other signals like the CVV match, IP geolocation, and device fingerprinting.

A truly smart AVS strategy isn't about trusting one tool completely. It's about understanding how it works alongside your other security measures to build a defense that stops fraudsters while welcoming every legitimate customer.

What Happens When AVS Isn't Enough?

So you've got your AVS rules dialed in perfectly. Does that mean you'll never see another dispute? Unfortunately, no. Even the best-run fraud prevention setup can't stop every single dispute, especially when you're dealing with "friendly fraud."

This is where your strategy has to pivot from prevention to smart resolution. The AVS data from the original transaction doesn't just get thrown away; it becomes a vital clue that helps you decide your next move.

Think about it: a customer disputes a charge that had a full AVS match. The name, street, and ZIP code all lined up perfectly. That’s a huge red flag that you're likely dealing with friendly fraud—a legitimate customer who forgot the purchase, doesn't recognize the charge, or has buyer's remorse. Your response to this should be completely different than for a transaction that had a glaring AVS mismatch.

From Prevention to Damage Control

When a dispute slips through the cracks, your goal is to contain the damage. This is where dispute alert services enter the picture, acting as a critical buffer between a customer complaint and a full-blown chargeback.

These services essentially get a heads-up when a customer contacts their bank to question a charge. Instead of letting it immediately turn into a chargeback, the alert service notifies you first.

Key Insight: A dispute alert gives you a precious 24-72 hour window to handle the issue directly with the customer, usually by issuing a refund. This stops the chargeback dead in its tracks and saves your merchant account from getting a penalty.

This is where you can connect your AVS data to your response using a platform like Disputely. By setting up automated rules, you can let the system do the heavy lifting. When an alert hits, the platform can look back at the original AVS response code and act based on your rules.

For example, you could set up a workflow like this:

• Full AVS Match: The alert is for an order where billing and shipping addresses were a perfect match. You might automatically refund it. Why? Because fighting a friendly fraud case, even with good evidence, is an uphill, expensive battle.
• Partial AVS Mismatch: Maybe the street address matched but the ZIP code didn't. You can flag these alerts for a human to review. A quick look might tell you whether a refund is the right call or if there's more to the story.
• No AVS Match: If the transaction had a total AVS failure, you could set a rule to never automatically refund. This points to a much higher chance of true criminal fraud, which is a case you might actually want to fight.

Building Your Complete Protection Playbook

By linking your front-end fraud filters with a back-end alert system, you create a much more robust defense for your business. Your AVS settings act as your first line of defense, screening out obvious fraud before the transaction is even approved.

For the handful of disputes that inevitably get past that first wall, your alert management system is your last line of defense. It gives you a final chance to resolve an issue before it escalates into a damaging and costly chargeback. This two-pronged approach is the key to protecting your revenue and keeping your merchant account in good standing with payment processors.

Your Top Questions About AVS, Answered

Even with a perfectly tuned system, you're bound to run into questions about how Address Verification Systems (AVS) work in the real world. Let's walk through some of the most common scenarios merchants face and get you some quick, clear answers.

What Should I Do If a Legitimate Customer Is Declined by AVS?

This happens more often than you'd think, and it's almost always a simple typo. The first thing you should do is guide the customer to carefully re-enter their billing address. Tell them to pay special attention to the street number and ZIP code, as those are the two most critical pieces for AVS.

It’s also common for people to move and forget to update the address with their bank. Have them confirm the address they're using is the exact one their bank has on file. If you've reviewed the order and feel confident it's legitimate, you might be tempted to override the AVS result and push the payment through manually. Be careful here. Doing this too often is a recipe for increased fraud risk. The safest move is to ask the customer to sort out the address discrepancy with their bank before they try the purchase again.

How Effective Is AVS for International Transactions?

The short answer is: it's a mixed bag. AVS works incredibly well for sales in the US, UK, and Canada because their banking systems are standardized and speak the same language. You can count on getting reliable results from transactions in those countries.

Once you step outside that zone, however, things get less predictable. Many international banks simply don't support the AVS protocol. When that happens, your payment gateway gets a response code that essentially says, "Sorry, can't check." Because of this, you can't rely solely on AVS for international orders. You have to layer your defenses, giving more weight to other tools like CVV checks, 3D Secure, IP geolocation, and device fingerprinting to get a clear picture of the risk.

Can AVS Prevent All Types of Fraud?

No, and it’s important to understand its limitations. AVS is a fantastic tool for stopping low-level fraud where a criminal has a stolen card number but doesn't have the matching billing address. It shuts that door pretty effectively.

But AVS offers little protection against 'friendly fraud,' where a legitimate cardholder disputes a valid charge, or account takeover fraud, where a thief has gained complete access to a customer's details.

Think of AVS as just one crucial player on your security team. To truly protect your business, you need a comprehensive strategy that combines multiple verification tools with a solid plan for managing disputes after the sale. If you need help building that post-transaction safety net, feel free to get in touch with our team through the Disputely support page for some guidance.

---

Even with the best AVS rules in place, some disputes will inevitably slip through. Disputely provides an essential safety net by stopping disputes before they turn into damaging, costly chargebacks. Our platform automatically intercepts alerts from Visa, Mastercard, and Ethoca, giving you a chance to refund the customer and protect your merchant account. Learn how Disputely can help you reduce chargebacks by up to 99%.