Address Verification Service (AVS)

TECHNIQUE OVERVIEW

Address Verification Services (AVS) is a tool provided by credit card associations and issuing banks to allow merchants to check the submitted billing address in order to see if it is on file with the issuing bank. The AVS check is usually done as part of a merchant’s request for authorization on the credit card. When a merchant makes a request, the address is checked against the address on file at the issuing bank. AVS is supported in the United States, Canada and the UK. Visa, MasterCard, American Express and Discover Card all support AVS. For other card types check with your payment processor. Key considerations when implementing or buying this functionality include:

• AVS is only available from banks. Merchants that are using payment software or gateways that talk about AVS should understand that these applications and services only support the AVS information flow and cannot offer a merchant the actual AVS check.

• AVS in the UK is set up differently than the U.S. In the UK, the AVS and card security check are combined in the same request and in the same response code, whereas in the U.S. the AVS and card security check are separated.

• If you are a merchant, you should contact your payment processor on the use and implementation of AVS. The AVS check is typically done as part of the authorization call and is done in real time on the e-commerce engine. In implementing AVS, you will need to have logic to interpret the codes that your payment processor sends back to you. You will need to properly route the order based on the information you get back from the payment processor.

• Typically it takes anywhere from a day to a week to implement AVS into your order process. The keys to quickly implementing AVS are to make sure you have a clear plan on what you want to do with an order, based on the return code from the AVS check.

HOW DOES IT WORK?

AVS, or Address Verification, is a tool provided by credit card associations and issuing banks to allow merchants to check the submitted billing address to see if it is on file with the issuing bank. The AVS check is usually done as part of the merchant’s request for authorization on the card. When a merchant makes a request, the address is checked against the address on file at the issuing bank. Only the first four to five digits of the address and the zip code are verified — everything else IS NOT CHECKED.

Example: Cardholders name and address is Mr. John Doe, 1234 USA Street Realtown, ST 56789

What would be sent to the issuing bank to be checked would be “1234” and “56789”

Merchants will get one of six codes back from their payment processor indicating what matched: full match, partial match-address, partial match-zip code, no match, international and unavailable. Using AVS as part of their risk solution is very beneficial, but relying solely on AVS is very dangerous. If a merchant implemented a rule in their solution that said they would only take orders that are a full match on AVS, they would have a very high insult rate, as the information contained in the issuing bank can be old, or the items being purchased could be as gifts. Merchants would leave a lot of business on the table if they implemented this type of rule.

Likewise getting a full match for AVS should tell a merchant something as well: that there is less risk. If the order’s address information is on file with the issuing bank and the merchant is shipping to the record on file, the consumer would have a hard time disputing they did not make the charge.

Regardless of the AVS return value, merchants can still get a valid authorization on a card. If a merchant got a no match that would be termed a “soft decline” in the eyes of the banks.

HOW DO YOU USE THE RESULTS?

In general, merchants should anticipate the majority of their orders coming in as a full match — plan on between 40 to 80%. Visa EU reported in early 2003 that they were seeing a 75% full match rate with those merchants that were using the new AVS service. Just because a merchant gets a response of partial match or no match does indicate increased risk in accepting an order. Remember AVS is not a good indicator of fraud. In case studies the highest actual fraud losses for any one AVS response code was only 11%, meaning 89% of the orders were valid and good orders. Some merchants will experience much higher fraud losses than this, but there are other rules, and fraud-prediction tools that will better isolate fraudulent behavior without sacrificing sales conversion.

Likewise getting a response from AVS of unavailable or international does not indicate increased risk either, with most merchants reporting the combined fraud losses for these two response codes being less than AVS full match. Some businesses can and will experience a much higher incidence of international fraud than others. This is especially true for digitally downloadable goods and services.

When evaluating how well AVS is doing for a merchant, don’t get trapped by the percent of fraud for any one given AVS response value. If you remember earlier in this discussion we pointed out that the highest percentage of orders will be AVS full match so the highest concentration of dollars at risk will be there, and typically the smallest fraud percentage of loss will also be found on AVS full match. This gives merchants a false sense of security that AVS full match doesn’t need their attention on fraud prevention, when this is the greatest number of dollars at risk, and the easiest way to fool most merchant’s internal screening procedures.

There are cases in which merchants do have very specific and significant skews on fraud in international and in no match categories. If the skew occurs, this is typically a sign of a fraud attack on the location, site or store.