An AVS test is an address check sent with a card authorization. The processor passes the billing street number and ZIP code to the issuer. The issuer compares them with the address on file and returns a one-letter code. That code is a data point. It is not an approve or decline decision. The merchant sets the rules.

What AVS compares

Two fields go into the check.

  • Street address: the numeric portion only. Letters and apartment data are dropped.
  • ZIP code: the full postal code, or the first five digits on US cards.

AVS runs on card networks in the US, Canada, and the UK. Issuers in other markets may return a blank result or a code that means the check was not supported. A blank result is not a fail.

Common response codes

  • Y: street and ZIP match
  • A: street matches, ZIP does not
  • Z: ZIP matches, street does not
  • N: neither matches
  • W: nine-digit ZIP matches, street does not
  • U: issuer does not support AVS
  • S: issuer does not support AVS at this time

Processors add their own codes on top of this list. Read the processor's response code table before you build rules around a code.

Testing in a sandbox

Payment processors publish test card numbers and test address values that force a chosen AVS result. Stripe, Authorize.net, and CyberSource each list them in their developer docs. The values differ by processor. One sandbox may return a full match for ZIP 42424 and another for 00000. Confirm the table for the account you are using, then repeat the test after any gateway or processor change.

What an AVS test does not do

AVS does not check the cardholder name. It does not check the CVV. It does not read the full street text. A match on both AVS and CVV raises the approval odds. It does not prove the buyer holds the card. Fraud teams pair AVS with CVV, 3-D Secure, device data, and order history.

Rules that work

  1. Decline on code N when the order ships to a new address.
  2. Hold on A or Z and request a second check.
  3. Skip AVS rules on international cards where the issuer returns U.
  4. Log every code with the order. Disputes need the record.