AVS Response Codes: Meanings, Filters, and Chargeback Evidence

AVS response codes are the single-letter results a card issuer returns when it compares the billing address a customer typed at checkout against the address on file. The letter tells you whether the street number matched, whether the ZIP matched, both, neither, or whether the check could not be completed at all. Reading those codes correctly, and configuring your gateway to act on them sensibly, is the difference between stopping fraud and declining paying customers.¹

AVS looks at two things only: the numeric portion of the street address and the five-digit ZIP code. It ignores the street name, city, and state. A typo in “Main Street” won’t trigger a mismatch, but transposing “123” to “132” will. The check runs in real time alongside the authorization request, usually inside a second or two.²

What Each Standard AVS Code Means

Most payment processors share the same core set of letters for domestic Visa and Mastercard transactions.³

Y — Full match. Both the street number and the five-digit ZIP match the issuer’s records. Lowest-risk result and the ideal response.
A — Street match only. The street number matches but the ZIP does not. Often a recent move or a ZIP typo.
Z — ZIP match only. The ZIP matches but the street number does not. Could be a data entry mistake or a deliberately altered address.
N — No match. Neither the street number nor the ZIP matches. The strongest negative signal AVS gives, though plenty of real customers land here by mistyping.
U — Unavailable. The issuing bank has no address data on file or doesn’t support AVS. Common with prepaid cards, gift cards, and some smaller institutions.⁴
G — International issuer. The card was issued by a non-U.S. bank that doesn’t participate in AVS. Blocking G will block most international orders.
R — Retry or system error. The AVS system timed out. The check didn’t happen; it’s not a match or a mismatch.
S — Service not supported. The card issuer doesn’t support AVS at all.

Network Variations and American Express Codes

Visa and Mastercard are largely aligned, but not perfectly. Mastercard returns a W code for a ZIP-match-only result in some situations where Visa returns a different letter, usually when the street address came in an unexpected format. Most gateways normalize these differences so you see a consistent set of codes, but anyone reviewing raw authorization data should know the variation exists.

American Express adds codes that also factor in the cardholder’s name, which Visa and Mastercard ignore during AVS checks:⁵

V: Name, billing address, and postal code all match.
F: Name doesn’t match, but the postal code does.
O: Name and address match, but the postal code doesn’t.
K: Name matches, but neither the address nor the postal code does.

If you accept Amex or sell internationally, build your fraud rules around these additional codes rather than treating every unfamiliar letter as a reason to reject.

What the Code Does and Doesn’t Tell You

A mismatch is not a decline. The issuer’s approve-or-decline decision rests on whether the card is valid and has available funds. AVS runs alongside that decision; it doesn’t override it. You can receive an approved authorization and a Code N on the same transaction.⁶

The reverse holds too. A perfect Y doesn’t prove a transaction is legitimate. Fraudsters who buy stolen card data usually get the billing address with it, so they can pass AVS cleanly. A code is one signal in a larger risk picture, not a verdict.

Configuring Your Gateway’s AVS Filters

Most gateways let you set automated rules that decline transactions returning specific codes. Getting the configuration right matters: too permissive and you absorb fraud losses, too strict and you reject paying customers.

Authorize.net’s default settings, representative of major gateways, automatically reject codes B, E, G, N, R, S, and U.⁴ That default is aggressive. Rejecting G, U, and S blocks almost every international order and every prepaid or gift card purchase. For a domestic retailer of high-value electronics, that may be exactly right. For a subscription service with international customers, it’s exactly wrong.

If you keep only one rejection filter, keep N. A confirmed mismatch on both street number and ZIP is the strongest negative signal AVS produces. If you decide not to reject N, there is little logic in rejecting U, G, or S, because those codes mean the check couldn’t be completed rather than that it failed. Rejecting incomplete checks while accepting confirmed mismatches is internally inconsistent.⁴

Merchants tend to focus on fraud prevention and underestimate the cost of false declines. Mastercard estimates that false declines across all fraud tools cost merchants roughly thirteen times more in lost revenue than actual fraud does. Overly strict AVS filters contribute heavily. The customer who mistypes a ZIP, who recently moved, or who uses a P.O. box that doesn’t match the card’s street address all look identical to fraud from the gateway’s perspective.

Handling Partial Matches: Codes A and Z

Partial matches sit in a gray zone. They’re riskier than Y but far less suspicious than N. Blind rejection here is the most common mistake merchants make. A better approach is to route A and Z into a manual review queue and scale your response to the order value, drawing on the kind of framework Chase recommends for its merchants:⁷

Small orders under $50 with a CVV match: flag for review but consider processing, especially for a customer with prior purchase history. Holding a $30 order rarely justifies the friction.
Mid-range orders: send a quick verification email or text asking the customer to confirm the billing address before you capture funds.
Orders of $200 or more: hold and verify directly. Call the customer, ask for a screenshot of a recent statement, or ask them to re-enter billing information.

Before treating a partial match as fraud, check whether the mismatch is really a formatting problem. “123 N Main Street Apt 4B” dropped into a single address field can trip up a gateway that expected the house number separated from the unit. Splitting the house number, street name, and apartment into distinct fields on your checkout form eliminates a meaningful share of false mismatches.⁷

Code U, Prepaid Cards, and Gift Cards

Non-reloadable gift cards and many prepaid debit cards branded Visa, Mastercard, or Amex will almost always return Code U, because the issuing bank either has no billing address on file or the card was never registered.⁴ If your gateway rejects U and your business accepts gift cards, every one of those transactions will fail.

The fix is to disable the U filter. Manage the added risk through other signals: CVV verification, shipping-address consistency, device fingerprinting, and order velocity checks on any transaction that returns U.

Pairing AVS With CVV and 3D Secure

AVS was never designed to work alone. It checks one dimension of a transaction and ignores the rest. A layered fraud strategy combines AVS with at least two other tools.

CVV/CVC verification. The three- or four-digit code on the physical card confirms the customer has, or recently had, the card in hand. When a transaction returns an AVS partial match but a CVV match, the risk profile drops considerably, because a fraudster working from stolen online data may not have the CVV.
3D Secure. Protocols like Visa Secure and Mastercard Identity Check add an authentication step, usually a one-time code sent through the cardholder’s bank. Successful 3DS authentication shifts fraud liability from the merchant to the issuer for most fraud-coded chargebacks. That shift doesn’t extend to non-fraud disputes like “item not received” or “not as described.”

The practical takeaway: if your platform supports 3D Secure and the transaction authenticates, an AVS partial match becomes much less concerning, because you’re protected from fraud chargebacks regardless. Selling high-value items without enabling 3DS leaves your most effective fraud shield turned off.

Using AVS Codes as Chargeback Evidence

When a cardholder disputes a transaction as unauthorized, your defense starts with the data captured at the time of sale. An AVS full match is one of the strongest pieces of evidence you can present, especially when the order shipped to the matching address. It shows the buyer supplied accurate billing details, which a random fraudster is less likely to do.

The opposite is also true. Accepting a transaction despite a confirmed mismatch leaves you exposed. Visa’s rules place fraud liability on the merchant in card-not-present transactions, and processing a Code N order essentially forfeits the argument that you took reasonable steps to verify the buyer.⁸

Visa’s 2026 Ban on Placeholder AVS Data

Effective July 25, 2026, Visa prohibits merchants and payment facilitators from submitting fabricated or placeholder data in AVS fields. Sending dummy addresses, a practice some merchants have used to bypass AVS checks or avoid declines when they don’t collect a billing address, will violate Visa’s core rules.⁸ Visa’s stated aim is cleaner verification data and better authorization approval rates across the network.

If you currently skip AVS collection or populate the fields with generic data, update your checkout flow before that date. If your business model genuinely doesn’t involve collecting a billing address, such as some in-app purchase flows, work with your processor to find a compliant approach rather than keeping placeholder values in the fields.

1
Stripe. What is Address Verification Service (AVS)?
2
U.S. Payments Forum. Address Verification Service (AVS)
3
Payments Insider. AVS Response Codes
4
Authorize.net Support Center. Understanding and Configuring the Address Verification Service (AVS)
5
Cybersource. AVS Codes for Other Processors
6
Visa Acceptance Support Center. Payments – AVS (Address Verification System) Results
7
Chase. AVS and Card Verification Data Codes
8
Visa. Visa Core Rules and Visa Product and Service Rules