Get ‘Commerce Protection Buyer’s Guide’ now
One of the most widely used fraud prevention tools in card-not-present transactions is the Address Verification Service, or AVS.
Originally developed for use with mail and catalog orders, AVS is now commonly used by e-tailers, and other card-not-present merchants, as a method to verify the validity of an order they receive. An AVS check compares the billing address used in the transaction with the issuing bank’s address information on file for that cardholder. Depending on whether they match fully, partially, or not at all, the merchant can use that information in their decision on whether or not to accept or cancel the order.
As such, seeing a full AVS match on a transaction during order review offers a basic level of assurance for merchants that the order is not fraudulent. However, most merchants don’t understand how best to use AVS in Ecommerce Fraud Detection, nor their liability on transactions they accept where the AVS check returned a full match.
In this article, we’ll give a background on AVS and the details on how the service works, share who holds the liability for paying a merchant chargeback on a transaction with full AVS match, and how to use AVS in order review.
If you are an online merchant evaluating commerce protection vendors, you might be interested in our free Commerce Protection Buyer’s Guide. This comprehensive guide outlines the evolution of commerce protection from fraud prevention and details the integral components of a commerce protection solution. Takeaway resources include:
- A sample RFI template to leverage in your evaluation process
- Tips on how to build a business case for a commerce protection solution
- How to evaluate ROI and understand the tools used to protect against fraud and chargebacks
- How to find the right solution for your business
Background
As a reminder, the goal of order review is for a merchant to confirm that the person placing the order and the cardholder are the same individual. AVS can be used as a method to verify this, because if the person placing the order and the cardholder both list the same billing address, they are likely to be the same person. Because of this, AVS is often very helpful to merchants during order review.
Specifically, AVS checks whether or not the numeric address and zip code entered in the order match with the address kept on record at the issuing bank. (Note: currently, AVS is only available in the US, UK, and Canada.)
For most merchants, the request for AVS verification on a transaction is automatically submitted via the payment gateway/processor alongside the payment authorization request. The request pings the issuing bank with the billing address information used in the order, and the service returns a code that corresponds to how well the address entered matches up with the address in the issuing bank’s file. As a result, a merchant can find themselves with a transaction where there is full, partial or no AVS match.
The most common AVS codes are below:
| AVS Code | Definition | Explanation |
| Y | Full Match | Street address and 5 digit ZIP code match |
| X | Full Match | Street address and 9 digit ZIP match |
| W | Partial Match | 9 digit ZIP code matches, street address does not |
| Z | Partial Match | 5 digit ZIP code matches, street address does not |
| A | Partial Match | Street address matches, ZIP code does not |
| G | International Card | Non-U.S. card issuing bank |
| N | No Match | No match on street address or ZIP code |
| R | Retry | Retry – System unavailable or timed out |
| U | Unavailable | Either address information is unavailable for that account or the card issuer doesn’t support AVS |
Depending on the AVS code returned, a merchant’s next step is either a cancellation of the order, further investigation or simply approval to ship.
Full AVS match, card associations, and merchant liability
Taking a step back, remember that card associations (e.g. Visa, MasterCard and American Express) dictate the transaction rules that banks must adhere to if they want to continue participating in the network and issuing branded cards. (For an overview of how online payments work, go here.) An example of the rules set is the interchange rate, and in the case of fraud, the maximum percentage of transactions that are allowed to end up as chargebacks.
Card associations also dictate the circumstances in which a merchant can contest a chargeback, in other words, when they have a right to represent themselves in a chargeback fraud detection dispute. For certain kinds of chargebacks, a merchant may not have representment rights, and may be forced to accept the chargeback.
In the case of a chargeback due to perceived fraud or an unauthorized charge, a merchant only has representment rights if they’ve attempted to verify the validity of the transaction, for example, by performing an AVS check. Showing a full AVS match gives the merchant a much stronger defense in a fraud-related chargeback dispute, and while it doesn’t guarantee that the merchant will win the dispute, it does aid their cause.
Unfortunately, many merchants misunderstand what having a full AVS match on a transaction truly means. Many assume that if there is a fraud-related chargeback on a transaction where there was a full AVS match, the merchant will not be held liable for the chargeback. In reality, the merchant may still have to participate in the chargeback dispute and provide evidence in order to win the chargeback. As mentioned above, a full AVS match is a compelling piece of information to provide in the dispute process.
As a result, many merchants often restrict their order acceptance to orders that pass a full AVS match. While this may be a relatively safe strategy for avoiding some fraud, merchants should understand that (1) this is not a strategy that will successfully avoid all fraud and (2) this will not remove their potential liability for fraud-related chargebacks where a full AVS match occurred.
So, why are merchants still held liable for fraud-related chargebacks on transactions where they verified that the cardholder and purchaser are seemingly the same person? The reason is cardholder rights.
Cardholder rights
As a reminder, banks that issue credit cards to consumers have professional obligations to their customers, in this case, the cardholders. When a cardholder reports an unauthorized transaction on their card, it is the bank’s duty to take that complaint seriously and to investigate. Even in the event of a full AVS match, the issuing bank would still need to respect the cardholder’s claim that an unauthorized transaction occurred and act accordingly.
After the issuing bank receives the dispute from the cardholder and reviews it, if the bank determines that the cardholder’s claim is valid, the issuer files a chargeback with the merchant’s acquiring bank. The acquiring bank then notifies the merchant accordingly and the chargeback dispute process begins in earnest.
Chargebacks on transactions with full AVS match
As mentioned above, in the event of an order where there was a full AVS match, and it ended up as chargeback due to fraud, a merchant may still have to engage in the entire chargeback dispute process to win the chargeback. While the merchant has representment rights, due to their attempts to verify the validity of the transaction, engaging in a chargeback dispute is a drain on the merchant’s time and resources. Many merchants simply opt to drop the dispute and write off the permanent loss of the order funds, in order to focus on running their business. On top of this, many merchants are unaware of card association rules regarding chargebacks and how to properly dispute the chargeback, so they find it easier to simply drop the whole matter.
How to use AVS properly in order review
Ultimately, the lesson here is that it is unwise to base acceptance of an order on a full AVS match alone. As we detailed in How to review an order, AVS is simply one tool in a merchant’s arsenal for order review.
AVS should be employed in the larger scope of data points a merchant considers when reviewing an order, alongside things like CVV, email address data, IP address, and past order history. A full AVS match doesn’t always mean the order should be approved, and no AVS match doesn’t always mean an order should be declined.
To read more about how to review an order, and how to use AVS in context of an order, go here.
