Address Verification Service
What is address verification service?
Address Verification Service (AVS) is a card network check that compares the numeric parts of the a enters at checkout against the address the holds on file. The issuer returns a single-letter response code showing how much of the address matched, and the merchant uses that code as a risk signal before settling on approve, decline, or review.
AVS was built for merchants taking orders by mail and phone, where nobody could inspect the physical card, and it carried over to e-commerce as the same problem scaled. The check only reads digits – the street number and the postal or ZIP code – so unit numbers, street names, and city fields don't affect the result. Coverage is concentrated among US, Canadian, and UK issuers; issuers in most other markets return a code meaning the check wasn't performed rather than a match or mismatch.
Key facts
- Also known as: AVS, address verification system
- Compares: the numeric portion of the street address plus the postal or ZIP code, not the full address string
- Returned by: the issuing bank, inside the authorization response
- Applies to: – e-commerce, MOTO, and phone orders
- Coverage: primarily US, Canadian, and UK issuers; elsewhere most issuers return a "not supported" code
- Output: a single-letter code such as Y, N, A, or Z, mapped by the acquirer or gateway before the merchant sees it
- Usually paired with: the check, which validates a code the issuer never prints in the address record
How it works
- Address capture. The checkout form collects the billing address, at minimum the street line and the postal or ZIP code. Without these fields the check can't run and the issuer returns an unverified code.
- Submission with authorization. The gateway attaches the address fields to the request and sends them to the issuer over the card network. AVS isn't a separate call – it rides along with the auth.
- Issuer comparison. The issuer strips the address down to its digits and compares them against the record tied to the card account.
- Response code returned. The issuer sends a letter code back alongside the approval or decline, indicating a full match, a partial match, no match, or an unverified result.
- Merchant decision. The code feeds alongside the CVV result, transaction amount, device signals, and velocity rules. A common configuration declines outright mismatches automatically and routes partial matches to manual review.
AVS response codes
Code sets differ by card network, and acquirers map raw issuer responses onto them before the merchant sees a result. The letters below are the set most consistently returned across gateways.
| Code | Meaning | Result |
| Y | Street address and 5-digit ZIP both match | Full match |
| X | Street address and 9-digit ZIP both match | Full match |
| M | Street address and postal code match (international issuers) | Full match |
| A | Street address matches, ZIP does not | Partial match |
| Z | 5-digit ZIP matches, street address does not | Partial match |
| W | 9-digit ZIP matches, street address does not | Partial match |
| B | Street address matches, postal code not verified (international issuers) | Partial match |
| N | Neither street address nor ZIP matches | No match |
| U | Address information unavailable at the issuer | Unverified |
| S | Issuer doesn't support AVS | Unverified |
| G | Non-US issuer that doesn't support AVS | Unverified |
| R | Retry – the issuer or network was unavailable | Unverified |
Unverified codes (U, S, G, R) say nothing about the cardholder. Declining on them rejects international orders wholesale without removing any signal.
Why it matters
- It blocks card-number-only attacks. An attacker working from a leaked card number rarely has the registered billing address, so a stolen-number attempt returns N where a legitimate order returns Y.
- It prices the transaction. Card networks charge card-not-present authorizations at higher interchange when address data is absent, so passing AVS fields keeps a transaction in a cheaper category.
- It costs approvals when tuned too tightly. Formatting differences alone – "Apt 2B" against "#2B", a PO box stored in a separate field, a cardholder who moved last month – produce partial matches on real orders. Declining every non-Y response pushes those into false declines and drags down .
- It supports dispute evidence, not liability transfer. A full AVS match is useful evidence in a response, but AVS on its own doesn't move fraud liability to the issuer. That shift comes from authentication.
