Address verification service (AVS) can be a quick, inexpensive way to confirm the legitimacy of a card-not-present (CNP) transaction. Unfortunately, AVS doesn’t always deliver the results merchants need — or expect.
Merchants may wonder how AVS works. AVS automatically compares the billing address a customer enters in a credit card transaction against the address the bank has on file. If they match, the merchant can be more confident their customer is who they say they are — or that they’re at least an authorized user of the credit card being used. If they don’t match, the merchant might consider declining the transaction.
While AVS is one of the most commonly used fraud prevention tools, it may not be the comprehensive solution merchants think it is for eliminating risk. But that doesn’t mean it can’t play an important role in fraud prevention. Merchants just need to understand how it works, why it’s sometimes ineffective, and what part it should play in their business.
Once a customer makes a card-not-present transaction, the merchant automatically sends a request for user verification to the credit card processor, using the billing address the customer provided. The processor then compares that address with the address on file with the issuing bank. If the addresses don’t sync, the issuing bank denies the transaction. If the addresses match, the bank approves the transaction and includes a response code that describes just how closely those addresses matched.
If the issuing bank approves the sale, the merchant can review the response code that was returned and evaluate the transaction against its own best practices to decide whether to accept the payment. But there’s a catch: If the merchant decides to process a transaction that has AVS discrepancies, that merchant will be held liable for all charges and damages if it turns out the purchase was made with a stolen credit card.
In all, the process takes just seconds to complete and is invisible to customers.
As a security feature, AVS can automatically reject potentially fraudulent transactions — which is great news for e-commerce merchants looking to reduce their fraud and chargeback ratios.
And even if merchants approve a transaction with full AVS match that later turns out to be fraudulent, showing the positive address match with proof the order was shipped to the cardholder’s address on file with the bank will strengthen a merchant’s case in a chargeback dispute.
Some merchants set up rejection settings that trigger an automatic decline if the issuing bank returns certain response codes. While this approach is efficient, automatically declining transactions is likely to result in an increased number of false declines, which means the merchant is rejecting legitimate orders.
Here are five other reasons why AVS isn’t always the most effective choice for correctly evaluating transactions.
AVS sounds simple: Either the addresses match or they don’t. But transactions themselves aren’t always that black and white. Here’s the problem: AVS doesn’t really verify an address. Instead, it simply analyzes only the numeric portion of the address, like the street number and the ZIP code. That’s it. And that can lead to ample opportunities for error at checkout. Customers mistakenly entering a 10-digit ZIP code instead of a 5-digit one, forgetting a suite or an apartment number, or making a simple typo are enough for the AVS to flag the address as a mismatch.
Consider, too, a customer who has recently moved but not yet updated their address with their credit card company. Chances are, AVS will decline the transaction, even though it’s a legitimate transaction.
Just because AVS can confirm an address match, however, doesn’t mean it’s the legitimate cardholder making the transaction. If a fraudster has purchased credit card data on the dark net, it’s likely they’ve got some other important customer data, too, like street numbers and ZIP codes.
AVS can currently be used only with addresses in the United States, Canada and the United Kingdom, making it ineffective for many international transactions.
Merchants must remember that not every payment method can take advantage of AVS. Prepaid debit cards rarely require customers to keep billing or shipping addresses on file, eliminating AVS as a useful screening tool.
Today’s fraudsters are savvy enough to have learned how merchants use AVS to flag purchases. To have their transactions approved, fraudsters will pick a shipping address that’s close in proximity to the billing address and that uses the same AVS number. So if the billing address is 123 Main Street, Anytown, NY, 12345, the fraudster may use 123 Maple Street, Anytown, NY, 12345 as the shipping destination and intercept the package there. The AVS details are similar enough to not raise suspicion, and the fraudster simply picks up the package at the new location.
Using AVS too aggressively could mean a merchant starts experiencing a higher volume of false declines, which can cost the merchant revenue, future sales and customer loyalty. But being too lax in reviewing transactional details can result in the merchant leaving themselves open to fraud and the risk a customer will file and win an expensive chargeback dispute.
For merchants in today’s e-commerce environment, address verification service is simply not strong enough on its own to let merchants confidently approve transactions. Instead, AVS can best be used as part of a multilayered fraud prevention system that may include 3-D Secure, IP address verification and multifactor authentication.
A layered approach — combining advanced artificial intelligence with skilled human review — is the perfect way to add AVS into a robust fraud prevention strategy. A managed services solution may be just the right approach for merchants who are looking for ways to make smart transaction decisions, mitigate fraud risk and minimize chargebacks.
Learn more about this solution by downloading a copy of ClearSale’s free “Is a Fraud Managed Services Solution Right for Your Business?” e-book. In it, we share everything you need to know about how to compare your options and choose the right fraud protection solution for your business.