# AVS and CVV Mismatches: When to Let the Order Through and When to Stop It

Source: https://bondproof.com/blog/2026-11-15-avs-cvv-mismatch-let-order-through.html

[Home](../index.md) / [Blog](index.md)


November 15, 2026 - BondProof

**Short answer:** AVS compares only the street number and ZIP code against the issuer's records, and CVV proves only that someone holds the card. Treat a mismatch as one signal in a weighted score, not as a verdict. Decline when both fail on a high-value order; review when one fails and everything else checks out.

## What the two checks actually compare

AVS, the Address Verification Service, compares the numeric parts of a billing address and nothing else: the street number and the ZIP or postal code, matched against what the card issuer has on file. The street name and the city are discarded. A customer who moved recently, typed a typo, or lives in a building with a confusing numbering scheme can fail AVS while holding the real card in their hand.

CVV is the three digits on the back of most cards, four on the front of an American Express. It proves the person entering it likely has physical possession of the card, and network rules forbid storing it after authorization. Not in a database, not in logs, not in a screenshot a support agent saved. That no-storage rule is what keeps the CVV meaningful for every other merchant: if it leaked into databases, it would stop proving anything.

## The codes are a score, not a verdict

Visa groups AVS results into four practical buckets: full match, partial match, no match, and unsupported or unavailable. A partial match, where only the street number or only the ZIP matches, is usually a moved customer or a typo, and the sensible response is a manual review on a higher-value order, not an auto-decline. An unsupported result, often coded S or U, means the issuer could not perform the check at all, which is a technical gap, not evidence of fraud. Coverage is dependable mainly for cards issued in the United States, Canada, and the United Kingdom; elsewhere, expect unsupported rather than a clean yes or no.

The authorization decision itself always overrides the AVS and CVV result. An issuer can approve a transaction on which AVS did not match and leave the accept-or-reject call to you. That is the design, not a bug: the checks are data points for your risk decision, and the decision is yours. The merchants who lose the most money to this are the ones who set a gateway rule once, usually decline-on-any-mismatch, and never look at what it costs them in real customers.

## A rule set that survives contact with real customers

Require CVV on every card-not-present transaction and decline or hold any order where it fails, because a real cardholder rarely fumbles their own security code repeatedly. That part is unambiguous. For AVS, set tiers: auto-decline only when both AVS and CVV fail, or when a full AVS mismatch pairs with a high-value order shipping to a different address. Flag partial matches for review above a dollar threshold you set from your own data, and let low-value partial matches through when the device, IP, and order history are clean.

Log every raw response code for two to four weeks before you change anything, and never set auto-decline on a partial match. The pattern in your own logs is worth more than any default rule a gateway ships with: if your partial-match orders almost never charge back, your customers move a lot or your address form is confusing them, and the fix is the form, not the rule. For the next layer up, [3-D Secure 2 and the friction it trades for chargeback protection](https://bondproof.com/blog/2026-11-13-3ds2-friction-chargeback-tradeoff.md) covers when a challenge is worth the drop-off, and [friendly fraud chargebacks](https://bondproof.com/blog/2026-11-14-friendly-fraud-chargebacks.md) explains what happens when the dispute is a real customer disputing a real order.

## Frequently asked questions

### What does AVS actually check?

AVS compares the numeric parts of the billing address, the street number and the ZIP code, against the card issuer's records. It ignores the street name and city entirely, so a typo or a recent move can fail the check on a legitimate order.

### Should I decline every order with an AVS mismatch?

No. A partial match is often a moved customer or a typo, and an unsupported result means the issuer could not run the check at all. Decline when both AVS and CVV fail, or when a full mismatch pairs with a high-value order shipping elsewhere. Review the rest.

### Why can't I store the CVV after authorization?

Network rules and PCI DSS forbid retaining the CVV after authorization. The code only proves possession because it exists nowhere except on the card itself. Once it sits in databases and logs, it stops proving anything.

### Does a full AVS match mean the order is safe?

No. A full match means the address matches the issuer's records, not that the buyer is the cardholder. Stolen card data usually includes the real billing address. AVS is one signal, and it has to sit next to device, velocity, and order-history signals.

## See your own numbers.

A free bot-traffic audit shows the human-automated split in your live traffic - no code changes, no commitment.

[Get a free bot-traffic audit](mailto:hello@bondproof.com?subject=Free%20free%20bot-traffic%20audit)