Address verification (AVS)

Address verification, commonly called AVS, is a fraud-prevention check that compares the billing address a customer enters at checkout against the address the card issuer has on file for that account. When a payment is submitted, the issuer returns a response code that shows whether the numeric parts of the address, usually the street number and the postal or zip code, match, partially match, or do not match. Businesses use that result to help decide whether to accept, review, or decline a transaction, which makes AVS a common layer of defense against fraud in card-not-present payments where the physical card cannot be inspected.

AVS works in the moment a payment is authorized. The customer supplies a billing address, the payment request carries the numeric portions of that address to the card issuer, and the issuer compares them to its own records and returns a response code. That code is the whole point of the check: it does not by itself approve or decline the payment, it reports how well the address matched so the business can apply its own rules. A full match, a partial match where only the zip code lines up, and a no-match each carry different risk, and a business decides in advance how to treat each outcome. AVS is most useful for card-not-present transactions, such as online checkouts, because in those cases the merchant cannot see the card or the person presenting it, so the address match becomes one of the few signals available. It is not a guarantee: a transaction can pass AVS and still be fraudulent, or fail AVS for an innocent reason such as a customer who recently moved, so most businesses use it as one signal among several rather than a sole decision. Some issuing banks do not participate in AVS at all, in which case the check returns a response indicating no comparison was possible rather than a pass or a fail.

Why address verification matters for subscription businesses

AVS matters because it gives a business an inexpensive, widely supported signal about whether the person paying actually controls the billing address tied to the card. For card-not-present businesses, that signal helps reduce fraudulent charges and the chargebacks that follow them, which protects both revenue and the business's standing with its payment processors. It also cuts the other way: rules that are too strict will decline legitimate customers whose address details do not match perfectly, so the value of AVS lies in tuning it to a business's own risk tolerance rather than rejecting every imperfect match. Getting that balance right protects revenue from fraud on one side and from unnecessary declines on the other.

For an operator, the value of AVS inside a subscription platform is that the check and the rules that act on its result live alongside billing, so address screening does not require a separate fraud tool. Recurly's documentation describes AVS as a configurable, gateway-backed control: a site can enable AVS, choose an AVS rule, and have Recurly apply rejection rules for supported mismatch responses while surfacing the response code exactly as the gateway returns it. Recurly's documentation also notes that AVS and card security code checks apply to initial transactions such as a customer's first sign-up rather than to later recurring charges, and that when AVS is enabled the checkout flow should capture billing information for every transaction to avoid a rise in declines. Recurly does not store the card security code, in line with PCI requirements. Whether a specific AVS rule, gateway behavior, or configuration fits a given business should be confirmed with the Recurly team for that account.

How to use address verification

Treat AVS as one input into a fraud decision, and tune how you respond to each result rather than accepting or rejecting on the match alone.

• Capture complete billing address details at checkout, because AVS can only compare what the customer provides, and a missing address will tend to produce a failing or unusable result.

• Decide in advance how to treat each AVS outcome, for example accepting a full match, reviewing a partial match, and declining or holding a no-match, based on your own risk tolerance.

• Combine AVS with other signals such as the card security code and broader fraud screening, since no single check is sufficient on its own.

• Account for legitimate mismatches, such as customers who have moved or who enter an address inconsistently, so that reasonable rules do not turn away good customers.

• Remember that some issuers do not support AVS, so build rules that do not automatically decline a transaction solely because no address comparison was possible.

Address verification vs card verification value (CVV)

AVS and the card verification value, or CVV, are the two checks most often confused because both screen card-not-present payments, but they verify different things.

• AVS compares the billing address the customer enters against the address the issuer has on file, and returns a code for how well the numeric parts match.

• CVV checks the short security code printed on the card, which confirms the person has the physical card in hand rather than just the card number.

• The two are complementary: AVS tests control of the billing address, and CVV tests possession of the card, so many businesses use both together as part of a single fraud decision. See Card verification value (CVV).

Benefits and examples

AVS gives a business a low-cost way to add address-based risk screening to card-not-present payments.

• An online checkout compares the entered billing address to the issuer's records and gets a full match, giving the business more confidence to accept the payment.

• A transaction returns a zip-code match but a street-address mismatch, so the business routes it to manual review instead of accepting or declining outright.

• A transaction returns a full mismatch on an order flagged as high risk, and the business declines it to avoid a likely chargeback.

• An issuer that does not participate in AVS returns a no-comparison response, and the business accepts the payment on other signals rather than declining a legitimate customer.

Frequently asked questions

What does AVS check? AVS checks whether the billing address a customer enters at checkout matches the address the card issuer has on file for that account. It compares the numeric parts of the address, usually the street number and the postal or zip code, and returns a response code showing whether they match, partially match, or do not match.

Does passing AVS mean a payment is not fraudulent? No. A passing AVS result lowers the risk but does not prove a payment is legitimate, because a fraudster who knows the billing address can still pass the check. AVS is meant to be used as one signal among several, alongside the card security code and other fraud screening, rather than as a sole yes-or-no decision.

Why would a legitimate customer fail AVS? A legitimate customer can fail AVS for ordinary reasons, such as having recently moved, entering an abbreviated or inconsistent address, or using a card whose issuer does not support the check. Because of this, treating every AVS mismatch as fraud will decline good customers, which is why businesses tune how they respond to each result.

What is the difference between AVS and CVV? AVS verifies the billing address against the issuer's records, while CVV verifies the short security code on the card. AVS tests whether the customer knows the address tied to the card, and CVV tests whether they physically have the card. Many businesses use both together to screen card-not-present payments.