Introduction
AVS, or Address Verification Service, is a payment-security tool used to compare billing-address information submitted during a card transaction with information associated with the payment account at the card issuer.
AVS is most commonly associated with card-not-present environments such as e-commerce, where the merchant cannot physically inspect the customer's card. Visa describes AVS as a service that can determine whether the issuer recognizes the billing address supplied by the user, while Mastercard describes AVS as comparing the payer's entered billing address with records held by the card issuer.
A successful address match does not prove that the buyer is the legitimate cardholder, and a mismatch does not automatically prove fraud. Addresses change, international formats differ, issuer participation varies, and legitimate customers make mistakes. For that reason, AVS works best as one signal within a layered fraud-prevention strategy.
This guide explains AVS from a defensive and payment-security perspective, including what it checks, how results are interpreted, where it is useful, and why merchants should combine it with authentication, fraud analytics, tokenization, and PCI DSS controls.
Quick Answer: What Is AVS?
AVS stands for Address Verification Service, although people sometimes casually call it an Address Verification System.
It compares billing-address information entered during a payment with address information recognized by the card issuer and returns a verification result to the payment ecosystem.
Visa lists AVS as one of the methods available through its Payment Account Validation service, alongside account verification, CVV2 validation, and Account Name Inquiry.
AVS is primarily a fraud-risk and payment-validation signal. It does not independently authenticate the customer's identity.
How Does AVS Work?
At a high level, the customer enters billing information during checkout. The merchant or payment processor includes relevant address data in the payment or verification request. The issuer or network then evaluates whether the submitted address information corresponds with its records.
The payment system returns an AVS result indicating a full match, partial match, no match, unavailable result, or another network-specific status.
The merchant can then combine that result with other information such as CVV validation, 3-D Secure authentication, device data, transaction history, customer account history, and fraud-risk scoring.
The exact fields compared and the response format depend on the network, issuer, country, processor, and payment platform.
What Address Information Does AVS Usually Check?
AVS commonly focuses on billing-address information rather than the shipping address.
Depending on the payment network and issuer, the comparison may involve the street-address component, postal or ZIP code, or both.
Visa's AVS documentation requires a postal code when address-verification data is included in its Payment Account Validation request, while Mastercard describes AVS as checking billing-address and postal-code information against issuer records.
Because address formats differ internationally, merchants should not assume that every issuer or country evaluates address fields in exactly the same way.
Billing Address vs Shipping Address
The billing address is the address associated with the payment account in the issuer's records.
The shipping address is where the merchant is asked to deliver goods.
AVS is generally concerned with billing-address verification. A different shipping address may be completely legitimate, such as when a customer sends a gift, travels, ships to a workplace, or uses a package-forwarding service.
Merchants may still evaluate shipping information as a separate fraud-risk signal, but shipping-address analysis should not be confused with AVS itself.
AVS vs Address Validation
Address verification and address validation are related but different concepts.
Mastercard distinguishes AVS from address-validation services. Address validation focuses on whether an address is correctly formed or deliverable, while AVS compares billing-address information against records associated with the payment account.
An address can therefore be perfectly valid for postal delivery but still fail to match the billing address known to the issuer.
Conversely, an issuer's stored address may match for payment purposes even if the address needs formatting changes for postal delivery.
Why AVS Matters for Card-Not-Present Payments
Card-not-present merchants do not have the same physical interaction with the card that occurs at an EMV-enabled point-of-sale terminal.
AVS adds another contextual signal that can help merchants determine whether payment details and billing information appear consistent with issuer records.
Visa says AVS is primarily used in e-commerce and other card-not-present environments, although it may also have limited use in some card-present situations where normal chip or magnetic-stripe data cannot be obtained.
The value of AVS is therefore greatest as part of remote-payment risk assessment, not as a replacement for stronger customer authentication.
What Does an AVS Match Mean?
An AVS match generally means the issuer or payment network recognized the submitted billing-address information according to the comparison performed.
A full match can provide a positive risk signal, but it does not prove that the customer is legitimate. A criminal may possess billing information as part of a broader data compromise, while a legitimate customer may produce a mismatch because of formatting, relocation, issuer records, or typing errors.
Merchants should therefore avoid treating AVS as a binary identity test.
What Is a Partial AVS Match?
A partial match means that one part of the address information matched while another part did not, depending on the fields checked by the payment network or issuer.
For example, a postal code may match while the street-address component does not, or vice versa.
A partial match should be evaluated together with the overall transaction context rather than automatically approved or declined.
Customer history, authentication results, purchase value, device signals, and other fraud controls can help determine whether the inconsistency is meaningful.
What Does an AVS Mismatch Mean?
An AVS mismatch means the submitted billing-address information did not match the address information recognized by the issuer for the fields being compared.
That can increase transaction risk, but it is not proof of fraud.
Legitimate reasons for mismatches can include a recent move, outdated issuer records, typographical errors, different address formatting, international address conventions, corporate-card arrangements, or customers using addresses differently across services.
A merchant should use the result as a risk signal rather than a standalone accusation of fraud.
What Does 'AVS Unavailable' Mean?
Sometimes the payment ecosystem cannot provide a meaningful AVS result.
Visa's response documentation includes situations where the issuer is not an AVS participant, address verification was not returned, or address information could not be verified for an international transaction.
An unavailable result is therefore different from a confirmed mismatch.
Merchants should distinguish between 'did not match' and 'could not be verified' when configuring fraud decisions.
Are AVS Response Codes Universal?
No. AVS response codes and their exact meanings can vary across card networks, processors, gateways, and regions.
Visa publishes its own request and response codes, while Mastercard gateways and other payment providers may expose their own normalized or network-specific results.
Merchants should rely on the documentation from their actual payment processor or gateway instead of copying an AVS-code chart from an unrelated provider.
This reduces the risk of incorrectly interpreting a response and declining legitimate customers.
Does AVS Work Worldwide?
AVS availability is not uniform worldwide.
Issuer participation, address-data quality, supported fields, network behavior, and local addressing conventions can differ by country.
Visa documentation explicitly includes cases where an international transaction cannot be address-verified because the issuer does not participate or no AVS result is available.
Global merchants should therefore avoid assuming that a missing or unavailable AVS result automatically indicates suspicious activity.
Does AVS Verify the Cardholder's Identity?
No. AVS verifies address information, not the identity of the person making the transaction.
A successful match indicates consistency between submitted billing information and issuer records. It does not prove that the person entering the information is the cardholder.
Modern customer authentication tools such as EMV 3-D Secure are designed to address the identity and authentication problem more directly.
The strongest e-commerce defenses combine AVS with authentication and broader fraud analytics.
AVS vs CVV
AVS and CVV checks evaluate different information.
AVS compares billing-address data with issuer records.
CVV or CVC validation checks the card-verification value associated with the card.
Neither check alone proves customer identity, and both can be combined with other controls.
A transaction can have a matching address but an incorrect verification code, or vice versa. Merchants should evaluate the complete risk profile instead of treating one field as decisive.
AVS vs 3-D Secure
AVS is an address-consistency check. EMV 3-D Secure is a customer-authentication framework for e-commerce.
3-D Secure can allow issuers to evaluate richer transaction information and request additional customer verification when appropriate.
The two technologies therefore answer different questions: AVS asks whether billing information corresponds with issuer records, while 3-D Secure helps determine whether the remote customer is authorized.
A layered merchant strategy can use both without treating either as a complete solution.
AVS vs PCI DSS
AVS is a transaction-risk tool. PCI DSS is a payment-data security standard.
PCI Security Standards Council describes PCI DSS as baseline technical and operational requirements designed to protect payment-account data in environments where it is stored, processed, or transmitted.
PCI DSS helps reduce the chance that payment data will be stolen in the first place. AVS helps provide contextual information when a transaction or account validation is being evaluated.
They therefore address different stages of payment security.
Can AVS Prevent All Online Fraud?
No.
Billing-address information can itself be compromised, customers can mistype legitimate addresses, and issuer participation is not universal.
AVS can improve decision quality by adding another signal, but modern payment fraud prevention typically combines multiple layers such as 3-D Secure, tokenization, CVV validation, behavioral analytics, account history, device intelligence, and issuer fraud monitoring.
Mastercard describes AVS as one tool that can help reduce fraud while supporting approval of legitimate transactions.
Can a Fraudster Have the Correct Billing Address?
Yes. Billing addresses are not necessarily secret authentication credentials.
They may be available through phishing, compromised accounts, data breaches, public records, stolen documents, or other sources.
This is precisely why a full AVS match cannot be treated as proof of legitimacy.
The defensive lesson for merchants is to combine address verification with stronger authentication and behavioral risk signals.
Why Legitimate Customers Can Fail AVS
False mismatches can occur for many ordinary reasons.
A customer may have recently moved. The issuer may still have an older address. An apartment number may be formatted differently. A postal code may have been mistyped. International address conventions can differ. Corporate cards may use centralized billing addresses.
Fraud systems that automatically decline every mismatch can therefore create unnecessary false declines and customer frustration.
Risk-based decisioning should consider transaction context rather than assuming every AVS mismatch is malicious.
How Merchants Can Use AVS Responsibly
Use AVS as one risk signal rather than a universal pass/fail rule.
Interpret response codes using the actual payment processor's documentation.
Distinguish a mismatch from an unavailable result.
Consider customer history, transaction value, authentication outcomes, device information, shipping context, and other fraud signals.
Use stronger authentication such as EMV 3-D Secure where appropriate.
Tune rules to reduce false declines as well as fraud losses.
Monitor the performance of AVS-based rules over time rather than assuming one configuration will work equally well in every country and customer segment.
AVS and False Declines
A false decline occurs when a legitimate transaction is incorrectly rejected as fraudulent.
Overly strict AVS rules can contribute to false declines, particularly for international customers, recently moved customers, corporate-card users, or customers whose addresses are formatted differently between merchant and issuer systems.
Mastercard positions AVS within transaction-optimization tools intended to reduce fraudulent transactions while also approving more legitimate payments.
The ideal fraud system therefore asks not simply 'Does AVS match?' but 'What does this AVS result mean in the context of all other available evidence?'
AVS and Manual Review
Some merchants route selected transactions to manual review rather than automatically accepting or declining them.
An AVS mismatch or partial match can be one reason to examine the broader transaction context.
Manual review should use legitimate transaction and customer information available to the merchant and should avoid intrusive or discriminatory assumptions.
High-quality fraud operations also measure whether review rules actually reduce fraud without causing excessive delays or customer abandonment.
AVS and Recurring Payments
Recurring and card-on-file payments can behave differently from a first-time e-commerce checkout.
Merchants should follow their processor's rules for when address verification is appropriate and avoid collecting unnecessary billing information merely because it was requested during the initial transaction.
Tokenization and stored-credential frameworks can allow future legitimate payments to occur without repeatedly exposing all original card details.
AVS remains a risk tool, not a reason to retain sensitive payment data indefinitely.
AVS and Digital Wallets
Digital wallets increasingly use tokenized payment credentials and device-level security.
In these environments, the merchant may receive different payment and authentication signals than in a traditional manually entered card transaction.
Whether AVS is available or meaningful depends on the payment flow, network, wallet, issuer, and processor.
Merchants should use the payment provider's recommended risk signals instead of forcing traditional AVS assumptions onto every tokenized transaction.
What Consumers Should Know About AVS
Consumers usually encounter AVS indirectly when an online checkout asks for the billing address associated with the card.
Use the billing information your card issuer has on file, and update your issuer when you move.
If a legitimate transaction is declined after an address change, verify that your billing information is current with both the issuer and merchant.
Do not interpret an AVS-related checkout error as proof that your card account has been compromised. Contact the issuer or merchant through official channels if the problem continues.
How Consumers Can Protect Billing Information
Billing addresses are less secret than PINs or one-time codes, but they are still part of a person's financial profile and should be handled carefully.
Avoid entering card and billing information into websites reached through suspicious links.
Use trusted merchants, secure important accounts with multi-factor authentication, monitor payment alerts, and report unauthorized activity promptly.
Never provide banking passwords, PINs, or one-time authentication codes to someone who unexpectedly contacts you and claims that an address check is required.
Common Myths About AVS
Myth: AVS verifies the customer's identity. Reality: AVS compares billing-address information; it does not authenticate the person.
Myth: A full AVS match guarantees a legitimate transaction. Reality: correct address data can be compromised along with other payment information.
Myth: An AVS mismatch proves fraud. Reality: legitimate customers can have mismatches because of moves, formatting, errors, or issuer data.
Myth: AVS works exactly the same in every country. Reality: issuer participation and address-verification support vary internationally.
Myth: AVS response codes are identical across every processor. Reality: merchants should use the code definitions supplied by their own gateway or processor.
Myth: AVS replaces 3-D Secure. Reality: AVS checks address consistency while 3-D Secure focuses on customer authentication.
Myth: AVS replaces PCI DSS. Reality: PCI DSS protects payment-data environments, while AVS is a transaction-risk signal.
AVS and Chargebacks: What AVS Does Not Prove
AVS can reduce fraud risk and therefore lower fraud-related chargebacks, but it does not guarantee chargeback protection. A successful AVS result does not prove the genuine cardholder authorised the transaction, and how AVS evidence is treated varies by network, dispute type, processor and merchant programme. Treat AVS as one layer in a dispute strategy, never as a standalone defence.
Where AVS is actually available
Availability is not uniform. AVS is commonly used in markets such as the United States, Canada and the United Kingdom, while issuer and processor support can differ elsewhere. It also compares the billing address attached to the card, not the shipping destination - so it says nothing about whether a delivery address is safe or deliverable.
Primary sources
- Stripe - "What is address verification service (AVS)?" (updated 21 August 2026)
- Cybersource - AVS response codes documentation
- Visa - Billing Address Verification with AVS, card-absent acceptance guidance
Conclusion
Address Verification Service helps payment systems answer a narrow but useful question: does the billing-address information submitted with a transaction correspond with information recognized by the card issuer?
That comparison can help merchants identify inconsistencies and add useful context to card-not-present fraud decisions.
But AVS has important limitations. Address information can be stolen, legitimate customers can make mistakes, issuers may not participate, international formats vary, and a successful match does not prove customer identity.
For those reasons, the strongest merchant strategy treats AVS as one signal within layered payment security: billing-address verification, CVV validation, EMV 3-D Secure, tokenization, PCI DSS, fraud analytics, account security, and transaction monitoring.
Used carefully, AVS can help reduce fraud without turning ordinary address differences into unnecessary declines for legitimate customers.
