Card-not-present transactions, the kind that happen online or over the phone, carry a higher fraud risk than payments made in person, since there’s no physical card or signature to confirm. Two of the most widely used tools for reducing that risk are Address Verification Service, or AVS, and Card Verification Value, or CVV, checks. Together, they add a layer of scrutiny that helps merchants tell legitimate customers apart from fraudulent ones.
Implementing AVS and CVV filters provides merchants with an effective first line of defense against card-not-present fraud, stopping unauthorized transactions before they can process. By verifying key security details with the card issuer during checkout, these automated screening rules allow businesses to protect revenue and maintain low chargeback rates without adding unnecessary friction for legitimate shoppers.
What Address Verification Service Does
AVS compares the billing address a customer enters at checkout against the address the card issuer has on file. During authorisation, the merchant’s payment processor sends the numeric portions of the address, typically the street number and postal code, to the card network, which forwards it to the issuing bank for comparison. The bank returns a response code indicating whether the address matched fully, partially, or not at all, and the merchant can use that result to accept, flag, or decline the transaction.
What CVV Verification Does
The CVV is the three- or four-digit security code printed on a payment card, separate from the account number, and it is not stored in the card’s magnetic stripe or chip data. Because the code is only visible on the physical card, requiring it during a transaction makes it harder for someone with just a stolen card number to complete a purchase. The processor checks the code entered against the value on record with the issuer and returns a match or mismatch result.
Why Using Both Together Matters
AVS and CVV each have blind spots on their own. AVS mainly protects domestic transactions and can produce false declines from something as minor as an abbreviated street name, while CVV alone doesn’t verify anything about the purchaser’s location. Used together, though, they meaningfully narrow the odds that a stolen card number alone is enough to complete a fraudulent purchase, since a fraudster would need both the correct address details and the physical card in hand.
Limitations Businesses Should Understand
Neither check is foolproof. A perfect AVS and CVV match doesn’t guarantee a transaction is legitimate, since sophisticated fraud can still pass both checks, and legitimate customers are sometimes declined due to typos or recent address changes. For this reason, most payment security strategies treat AVS and CVV as one layer among several, pairing them with tools such as 3D Secure authentication, velocity monitoring, and device fingerprinting rather than relying on them in isolation to catch every fraudulent attempt.
Conclusion
AVS and CVV checks remain two of the simplest and most cost-effective fraud prevention tools available to merchants handling card-not-present transactions. Understanding what each one actually verifies, and where their limits lie, helps a business use them as part of a broader, layered approach to payment security.
