How To Use An AVS Check To Reduce eCommerce Fraud & Protect Your Business
Like it or not (and you won’t like it), credit card processing comes with a bewildering variety of small, nickel-and-dime fees that add to your costs in ways you might not even be aware of. One fee that you might have seen on your credit card processing statement is the AVS Fee. If you’re an eCommerce merchant, you probably already know what this is, but if you’re in retail, you most likely don’t see it very often and may not understand how it works.
In this article, we’ll explain what AVS is, how to use it, and how much it might cost you in additional processing charges.
Table of Contents
What Is AVS?
AVS is an acronym for the Address Verification Service, a feature that’s used to compare the address given to you by your customer and the billing address on file with the cardholder’s issuing bank. AVS serves two primary functions: (1) to deter fraud by confirming that the customer is the legitimate cardholder, and (2) to help prevent chargebacks by giving you additional information to verify your customer’s identity. AVS is provided by Mastercard, but is used by all major credit card brands in the United States, Canada, and the United Kingdom.
Use of the Address Verification System isn’t necessary for all credit/debit card transactions. In fact, the only time you’ll need to use AVS is for card-not-present transactions and keyed-in transactions, which could happen if for some reason the credit card terminal at your physical store is unable to read the customer’s magstripe or EMV chip.
Using AVS is actually very simple. In addition to their credit card information, your customer also provides a billing address. This information is submitted to your credit card processor, which queries the AVS system to determine whether the customer-provided address matches the billing address on file with the credit card’s issuing bank. AVS can be set up to run automatically through a payment gateway or virtual terminal, or you can manually query the system through your credit card terminal. The Address Verification System will compare the submitted billing address with the one on file with the issuing bank, and return a code that tells you how closely the two addresses match.
What Is An AVS Fee?
Nothing comes for free, of course. So, whenever you use the AVS feature, you have to pay for the use.
If your business is retail-only, you’ll only rarely need to use AVS, so the impact on your processing costs will be minimal. On the other hand, if your business is eCommerce-only, mail order, and/or telephone order, you will need to use AVS for every transaction. If you’re in one of these types of businesses, the cost of using AVS can be substantial, depending on how (and whether) your credit card processor charges you for using it. If you process a lot of B2B transactions, you should also be aware that some processors require the use of AVS to process Level II and III credit card data.
Mastercard charges an automatic AVS assessment fee whenever AVS is used, regardless of the circumstances. This fee is currently $0.01 for card-not-present transactions and $0.005 for card-present transactions. Your processor has to pay this fee to Mastercard when they process your transaction, and they’ll usually pass it on to you in one form or another.
If you use Square (see our review) or a similar payment service provider and are on a flat-rate pricing plan, you won’t pay a separate AVS fee. Instead, Square incorporates this fee into their processing rates. Note that Square, along with almost all other providers, charges a higher rate for eCommerce and keyed-in transactions. While a lot of this increased rate reflects the higher risk associated with card-not-present transactions in general, use of the AVS service is also included.
If your processor uses a tiered pricing plan, you may or may not be charged a separate AVS fee for each transaction, but this depends on your processor. However, using AVS for a card-not-present transaction is usually a requirement for placing that transaction in the qualified tier. Conversely, failure to use AVS will often result in the transaction being downgraded to nonqualified, and you’ll pay a much higher fee for processing it. Because the nonqualified rate will cost you up to two or even three times the qualified rate, you’ll save money using AVS – even if you have to pay a fee for it.
Merchants on an interchange-plus pricing plan may or may not be charged a separate AVS fee, but the use of AVS will give you a lower interchange rate, thus reducing the cost of processing your transaction. Again, in most cases, the savings from the lower interchange rate will more than offset the cost of the AVS fee.
Subscription-based pricing works the same way as interchange-plus, with the exception that you usually don’t pay a percentage markup on your transactions. Once again, you’ll save money overall by using AVS for your card-not-present transactions. Note that most providers offering subscription pricing usually don’t tack on extra fees like the AVS fee, as you’re already paying a monthly subscription fee that’s intended to combine these and other costs associated with maintaining your merchant account.
To find out how your provider handles the AVS fee, you’ll have to wade through the fine print in your contract. Although some of the more transparent providers disclose this information on their website, most do not. Most providers that impose a discrete AVS fee will charge anywhere from $0.01 to $0.25 per transaction where AVS is used. These fees can add up quickly, especially if you process a high number of small-ticket transactions. Other providers might simply include this extra cost in their rates for card-not-present transactions, as you will be using AVS for 100% of these types of transactions.
Because of the potential for AVS fees to add significantly to your processing costs, some providers will permanently waive the fee if your business is eCommerce-only. Businesses with both a retail and an online presence probably won’t be so lucky.
What Does An AVS Mismatch Mean?
The Address Verification System will compare the submitted billing address with the one on file with the issuing bank, and return a code that tells you how closely the two addresses match. So, whenever anyone speaks of an “AVS mismatch,” they mean one of the following things in the table below.
Common AVS Codes
Here’s an overview of the most common codes returned by the AVS, and what they mean:
Common AVS Codes (for Visa, Mastercard, and Discover)
|B||No address information submitted, AVS check could not be performed|
|E||AVS data provided is invalid (or AVS is not allowed for the card type submitted)|
|R||AVS unavailable at the time transaction was submitted. Retry transaction|
|G||Credit card issuing bank is of non-U.S. origin and does not support AVS|
|U||Address information is not available for the customer's credit card|
|S||U.S. card issuing bank does not support AVS|
|N||Neither street address nor 5-digit ZIP code matches address and ZIP code on file for card|
|A||Street address matches, but 5-digit ZIP code does not|
|Z||First 5 digits of ZIP code matches, but street address does not|
|W||9-digit ZIP code matches, but street address does not|
|Y||Street address and first 5 digits of the ZIP code match perfectly|
Note that there are additional codes that you might see. However, they’re far less common than the codes listed in the table above.
Learning To Read AVS Codes
Once you get a code from the AVS system, what happens next? In some cases, your credit card processor will automatically decline a transaction if certain AVS mismatch codes are returned. If this happens, your only recourse is to ask the customer for an alternative billing address and try again.
Other times, you have to decide whether to accept or reject the transaction. There are legitimate reasons why a customer might inadvertently supply an incorrect billing address. For example, your customer might have recently moved but hasn’t updated their new billing address with their credit card company. Or perhaps the customer simply doesn’t remember their address correctly. However, if the customer doesn’t provide the correct address on the second try, there’s a very good chance that it’s because the card is stolen, and the customer has no idea where the actual cardholder lives. In this case, you should decline the transaction.
In a retail setting, a merchant will have to decide whether to accept a transaction if the Address Verification System returns a code indicating something other than a perfect match. Different AVS codes present varying levels of risk in accepting the transaction, as summarized here:
AVS Risk of Transaction Approval
|Transaction Approved If:||AVS Codes:||Risk Level:|
|ZIP code or street address do or do not match||None||High|
|Street address matches||B, N and Z||Medium|
|5-digit ZIP code matches||B, N and A||Medium|
|Either 5-digit ZIP code or street address match||B and N||Medium|
|Both 5-digit ZIP code and street address match||B, N, A and Z||Low|
|Both 9-digit ZIP code and street address match||B, N, A, Z, W and Y||Extremely Low|
Again, retail merchants will have to make a decision based on the level of risk if a partial mismatch occurs. We recommend that you set specific policies regarding which AVS codes will be approved and which will be declined, and that you ensure your employees are trained to recognize AVS codes that will require them to reject a customer’s card. Mail order and telephone order businesses will also have to set similar policies to ensure consistency in accepting or declining transactions.
For eCommerce businesses, things are a little easier. In most cases, you can set up your payment gateway to automatically accept or reject transactions based on the returned AVS code. Popular gateways such as Authorize.Net (see our review) allow you to configure your gateway to automatically accept only transactions where specified AVS codes are returned. You’ll want to exercise extreme caution in selecting which codes to approve based on the overall level of risk. Accepting too many partial mismatch codes can leave you vulnerable to fraud and chargebacks. At the same time, you might lose a lot of sales if your AVS code acceptance policies are too restrictive.
Although you’ll obviously want your gateway to be able to process transactions automatically 24/7 without input from you, we suggest that you set up a system to automatically email a customer notifying them that their transaction was declined due to an AVS mismatch. This gives the customer a chance to either correct the billing address information or submit an alternate payment method, and keeps you from losing a sale.
Why You Should Be Wary of “AVS Rejected” Messages
If you get an “AVS Rejected” message, then it’s a huge red flag that something is wrong with the transaction. Most of the time, this means that the credit card company suspects fraud. A hacker using stolen payment information is unlikely to know the actual card owner’s physical address. This is why most merchant services providers mandate the use of AVS for all eCommerce transactions, so this tool automatically comes as a part of your merchant account.
Using AVS won’t eliminate card-not-present (CNP) fraud, but it will lower the chances of it happening to you. Likewise, it will reduce instances of chargeback fraud, which is also becoming more common. If the address the customer provided and the address on file with the issuing bank matched when you processed the transaction, this provides additional evidence to improve your chances of successfully defending against the chargeback. Better yet, effective use of AVS/AVS Rejected message can lower the chances of a chargeback occurring in the first place.
Obviously, there are a number of legitimate reasons why a customer would want to ship an order to a different address. However, fraudsters almost always ship orders to somewhere other than their victim’s billing address. It’s in your best interest to verify the shipping address – just in case.
How To Use Credit Card AVS Checks To Protect Your Online Business
If you run an online business, you already know that an AVS check is a required step whenever you process credit card transactions. In fact, in some chargeback cases, not having an AVS check automatically means the merchant loses the dispute. Fortunately, it’s fairly easy to run the check. In most cases, you can set up your payment gateway to automatically accept or reject transactions based on the returned AVS code. For popular gateways such as Authorize.Net (see our review), all you have to do is to configure it to automatically accept only transactions where specified AVS codes are returned.
You’ll want to exercise extreme caution in selecting which codes to approve based on the overall level of risk. Accepting too many partial mismatch codes can leave you vulnerable to fraud and chargebacks. At the same time, you might lose a lot of sales if your AVS code acceptance policies are too restrictive. Although you’ll obviously want your gateway to be able to process transactions automatically 24/7 without input from you, we suggest that you set up a system to automatically email a customer notifying them that their transaction was declined due to an AVS mismatch. This gives the customer a chance to either correct the billing address information or submit an alternate payment method, and keeps you from losing a sale.
Don’t Use An Address Verification System As Your Only Fraud Prevention Tool
The Address Verification Service provides valuable protection for your business from both fraud and the possibility of a chargeback. While it isn’t foolproof, it’s far better to use it rather than simply accepting all transactions without it. In this sense, AVS is worth paying a little extra for and is in no way a “junk” fee.
At the same time, you’ll want to make sure that your provider isn’t ripping you off by charging an AVS fee that’s much higher than what they have to pay to Mastercard for the use of the service. Your best defense is to discuss the AVS fee with your sales representative when negotiating the terms of your merchant account. And, by all means, read your contract documents thoroughly before signing to ensure that what your sales representative told you is reflected in your legally-binding contract.
eCommerce merchants are particularly vulnerable to overpaying for the Address Verification Service, and you’ll want to choose a provider that will either waive the AVS fee entirely or merely charge you the pass-through cost. Paying significantly more than this will add up quickly if you’re assessed an AVS fee on every single transaction that your business processes.
We also recommend that eCommerce merchants set the automatic rejection policies on their payment gateways to balance the risk of fraud against the possibility of lost sales from legitimate customers. Your provider can help you select automatic rejection policies that will meet this goal.
Each provider treats AVS fees differently, so you’ll want to research this issue before considering a particular provider for your business.
Lastly, don’t use AVS as your only fraud prevention tool. Instead, in addition to AVS, use a layered approach that incorporates firewalls, good password security measures, and CVV/CVC checks. Automated fraud scoring tools, such as IP geolocation, AVS, CVV, and device fingerprinting tools can be used together to determine a fraud probability score. Also, be sure to re-screen orders that are modified by the customer after being placed, but before the goods have been shipped. At the same time, don’t be too trigger-happy when it comes to blocking transactions. Frequently screening out legitimate transactions will frustrate your customers and cost you their business. In an era where anyone can post their opinion of a business online, this could really hurt you in the long run.