# AVS Codes, Decoded: What Y, A, Z and N Actually Tell You

Source: https://bondproof.com/blog/2026-11-07-avs-codes-decoded.html

[Home](../index.md) / [Blog](index.md)


**Short answer:** AVS checks two numbers and nothing else: the street number and the five-digit ZIP. A Y means both match. An N means neither does. Everything else is a partial match that calls for a judgment call, not an auto-decline.

## What AVS actually compares

The Address Verification Service compares the billing address a customer types at checkout against the address the card issuer has on file, and it returns a single-letter code. The check is narrower than most merchants assume. It pulls out two numeric elements and nothing else: the street number, such as 42 from 42 Oak Street, and the five-digit ZIP code. It does not verify the street name, the city, the state, or the country.

That narrowness has a sharp edge. 42 Oak Street and 42 Elm Avenue both pass the street check if the house number is 42, because the system never looks at Oak or Elm. A fraudster who knows the correct house number and ZIP code, but not the full address, passes AVS. The system was built around US address formats, and it catches clear mismatches well, but it cannot tell a careful fraudster from a careful customer.

## The five codes that matter

Y is the full match: street number and five-digit ZIP both line up with the issuer's records. It is the strongest positive signal AVS gives, and the lowest-risk result. X is stronger still, the street number plus the full nine-digit ZIP, though Visa has been consolidating its results and most merchants now see Y, A, Z, N, U, and R.

A is a street match only: the number matched, the ZIP did not, often a customer who recently moved or mistyped the ZIP. Z is the mirror: the ZIP matched, the street number did not, which can mean a data entry error or a deliberately altered address. N is the no match, neither element lines up, and it is the strongest negative signal AVS provides. U means the issuer could not perform the check at all, which is common on international cards. Only N is a meaningful fraud signal on its own. The middle two are classic honest mistakes.

## The two mistakes merchants keep making

The first mistake is auto-declining A and Z. A customer who moved last month, or who transposed two digits in the ZIP, produces exactly those codes, and declining them costs real orders from real people. The better rule is to hold A and Z for review on high-value orders and let them through on low-value ones, ideally with a second check such as CVV or device data doing the work AVS cannot.

The second mistake is the mirror image: treating a Y as a clean bill of health. Stolen card data is usually sold with the billing address attached, so a fraudster with a full record passes AVS without trying. And AVS itself does not decline anything. It only reports a result. The decline comes afterwards, from the issuing bank or from the merchant's own risk rules, and a Y match leaves the merchant carrying the chargeback when the real cardholder disputes the charge. Use AVS as one signal among several, and let N be the only code that declines by itself.

Keep reading: [Promo Code Stacking: How Bots Drain Discount Budgets at Checkout](https://bondproof.com/blog/2026-11-07-promo-code-stacking-bots.md), [3-D Secure 2 vs Card Testing Bots: Where the Friction Actually Helps](https://bondproof.com/blog/2026-11-07-3ds2-card-testing-bots.md).

## Frequently asked questions

### What does an AVS code N mean?

N means neither the street number nor the five-digit ZIP matched the address the issuer has on file. It is the highest-risk result AVS produces, and most fraud guidance recommends declining it automatically on domestic cards. It still flags plenty of honest customers who typed their address wrong, so the decline should come with a clear path to retry.

### Why did a legitimate customer get an AVS mismatch?

Three common reasons: the customer moved and the issuer still has the old address, a typo in the street number or ZIP, or a card from a country where AVS is barely supported. AVS checks only the numeric street number and the five-digit ZIP, so a transposed digit is enough to fail it. A mismatch is not proof of fraud; it is proof the numbers did not line up.

### Does a Y match protect me from chargebacks?

No. AVS does not shift fraud liability to the issuer. A fraudster who buys stolen card data often buys the address with it, so a Y match on a stolen card is entirely possible, and when the real cardholder disputes the charge, the merchant still bears the chargeback. A Y is one piece of evidence, not a guarantee, and it should never be the only check on a high-value order.

### Where does AVS not work?

AVS is primarily a US, UK, and Canada feature. Cards issued in most other countries return code U, unavailable, or G, international AVS not applicable, because the issuer does not support the check. Treating a U as a fraud signal would block most international customers for no reason; it calls for a different screen, not a decline.

[Get a free bot-traffic audit](mailto:hello@bondproof.com?subject=Free%20free%20bot-traffic%20audit)