What Is AVS? Address Verification Service Explained

What is AVS? Address Verification Service is a check that compares the billing address a shopper types at checkout against the address the card issuer has on file. The issuer sends back a single letter telling you how much of it matched. That's the whole mechanism.

AVS is a card-absent tool. Visa's rules say a merchant may use it "for a Transaction in the Card-Absent Environment", which means online, phone, and mail orders (Visa Core Rules and Visa Product and Service Rules, 18 April 2026, section 10.11.1.1). In the US there's one carve-out: unattended terminals under MCC 4111 (commuter transport), 4112 (passenger railways), and 5542 (automated fuel dispensers) can run it too. That's why a gas pump asks for your ZIP.

AVS Checks an Address, Not a Person#

This is the distinction that trips people up. AVS tells you whether the address entered matches the address on file. It doesn't tell you the shopper is the cardholder.

Anyone holding a stolen card and a stolen billing address passes AVS. Anyone who moved last month and forgot to tell their bank fails it. The signal is real but narrow, and treating it as identity verification is how good customers get blocked.

For actual identity assurance in card-absent sales you want 3D Secure, which authenticates the cardholder with the issuer and moves liability. AVS does neither.

Visa Requires the Postal Code. The Street Address Is Optional#

Here's something the common explanation gets wrong. Almost every article says AVS checks "street address and ZIP code". Visa's actual issuer requirement is narrower.

Effective 1 October 2025, issuers in the US, Canada, Europe, and parts of Asia Pacific must verify the postal code "for Visa Regions where postcodes (or country equivalents) are in use, and may optionally verify street address" (section 10.11.1.2, ID# 0004679).

So the postal code check is mandatory for the issuer. The street address check is discretionary. That's a good part of why you see so many Z responses, where the ZIP matched and the street didn't. Sometimes the street genuinely didn't match. Sometimes the issuer just didn't look.

Build your rules around that reality rather than around an assumption that every issuer scores both fields the same way.

The AVS Response Codes#

The issuer returns one letter. These are the codes as published in the Authorize.net API reference, which is Visa's own gateway product:

Only N is a genuine mismatch on both fields. Everything from U down is an absence of information, not evidence of fraud. Declining on U, S, G, or R mostly means declining international cards and small issuers.

AVS Does Not Protect You From Chargebacks#

This is the most expensive misconception in the list, so it's worth being blunt: in the United States, a passing AVS result gives you no dispute protection whatsoever.

Visa publishes a list of conditions that make a fraud dispute invalid under Dispute Condition 10.4, Other Fraud in the Card-Absent Environment (section 11.7.5.3, ID# 0030254). That list is where merchant protections live. It includes CVV2 result conditions, and it includes Visa Secure with EMV 3-D Secure where the issuer returned an authentication confirmation and the CAVV was present.

AVS is not on that list.

There is an AVS liability shift coming, and it deliberately skips the US. Visa is "introducing the Address Verification Service (AVS) and disputes liability shift in selected countries" in Asia Pacific (Australia, New Zealand, Singapore), Europe, and Latin America and the Caribbean (Argentina, Brazil, Mexico, Paraguay, Peru, Puerto Rico, Uruguay), effective 24 October 2026, with a further phase on 24 April 2027. The United States and Canada are not in that list.

If you sell in the US and you've been telling yourself AVS is part of your chargeback defense, it isn't. Your protection comes from authentication and from evidence quality. That's the ground chargeback representment is actually fought on.

A Rule Change Lands on 25 July 2026#

From 25 July 2026, acquirers must ensure that AVS data sent in authorization requests "contains genuine Cardholder address data that the Merchant obtained directly from the Cardholder" (section 10.11.1.5, ID# 0031044). The same requirement is written into account verification processing (section 7.3.10.2).

Read that as what it is. Visa is closing off the practice of populating AVS fields with data the merchant filled in, inferred, or carried over from somewhere else in order to manufacture a match. If your checkout auto-completes a billing address the customer never typed, or your gateway back-fills it from an old order, that arrangement has a deadline on it.

Worth an audit now rather than in July. Ask your gateway one question: where does the address in the AVS field come from on every transaction type you run, including recurring ones?

Where AVS Belongs in a Fraud Stack#

AVS is cheap, fast, and weak. That combination makes it a scoring input, not a gate.

Used well, an AVS result is one factor among many: order value, velocity, device signals, tokenized card reuse, and history with the customer. A single N on a $40 order from a repeat buyer means little. The same N on a first-time $3,000 order shipping to a freight forwarder means quite a lot.

Used badly, AVS is a hard decline rule that silently kills revenue. Card-absent merchants who auto-decline every non-Y response typically lose more to false declines than they ever lost to the fraud they were blocking, and they lose it from good customers who don't come back.

If you're deciding how much of this to build yourself, that trade-off is the subject of in-house versus third-party fraud screening. The screening question sits upstream of the AVS question.

Practical Settings That Don't Cost You Sales#

A few rules that hold up in card-absent portfolios:

Treat Y, X, A, W, and Z as acceptable on their own. Only Z and A carry any real added risk, and both are common enough among legitimate buyers that blocking them is expensive.

Never hard-decline U, S, G, or R. Those are silence, not signal. Blocking them is close to a policy of refusing international cards.

Reserve declines for N combined with something else. N plus a high-value first order, or N plus a mismatched CVV2, is a reasonable stop. N alone is not.

Log the code on every transaction. When you file a dispute response later, the AVS result is part of the story you tell about the order, even though it isn't a protection in its own right.

Keep the field honest. After 25 July 2026 the address you send has to be the address your customer gave you.