The short answer
AVS and CVV response codes are the short results a card issuer sends back with an authorization. They say whether the billing address and the card security code the customer gave match the issuer's records. The common results are match, no match, not verified, not provided, and issuer does not participate. A response code is a risk signal, not an approval or a decline. An issuer can approve a sale that failed a check, so your checkout or your staff has to decide what to do with each result.
What AVS and CVV actually check
Visa's Dispute Management Guide for Merchants (October 2026 edition) describes the Address Verification Service (AVS) as a way for card-not-present merchants to check the billing address a customer gives, street address and/or ZIP or postal code, against the address the card issuer has on file. It describes CVV2 as the security code that phone and internet merchants ask for to check that the customer has a legitimate card in hand. The names vary by brand and by provider: Visa says CVV2, American Express uses CID, and many gateways simply say CVC. Both checks normally travel inside the authorization request, and the issuer sends a result code back with its approval or decline. Visa also describes stand-alone checks with no sale attached: its Account Verification Service for AVS and Zero Amount Account Number Verification for CVV2, both available in all regions. These checks are built for card-not-present sales: online checkout, phone and mail orders, virtual terminal entries and payment links.
The common results and what they mean
| Result | Letter | What it means | Usual next step |
|---|---|---|---|
| Match | M | The address or code matches the issuer's records | Accept if the rest of the order looks normal |
| No match | N | The address or code does not match | CVV: decline or review. AVS: review, especially on high-value orders |
| Not verified | U | The issuer received the data but did not check it, often because the sale was declined first | Look at the authorization result before anything else |
| Not provided | I | No address or code was sent | Fix the checkout form, unless it is a stored-card charge |
| Issuer does not participate | S | The issuer does not support the check, which Braintree says usually means a bank outside the US, Canada and the UK | Rely on other signals, such as 3-D Secure |
| System error | E | A system error stopped address verification | Retry the check or review the order |
| Not applicable / skipped | A / B | The transaction type does not support the check, or it was skipped | Confirm the check is switched on for that channel |
Treat the letters as an example, not a standard. Visa's guide says AVS availability, response codes and implementation may vary by market and acquirer. Braintree returns separate street address and postal code results. Stripe reports each check (address line, postal code and CVC) as pass, fail, unavailable or unchecked. Other gateways return a single combined AVS letter that covers street and ZIP together. Before you write any rule, get your gateway's own response code list and map each value to one of the results above.
Why an approved sale can still carry a failed check
Approval and verification are separate answers. Visa's guide says the issuer sends the CVV2 result back along with the authorization decision, and that the merchant should evaluate the result, together with the authorization decision and any other questionable data, before completing the sale. So a sale can come back approved with a CVV no-match or an AVS no-match, and if nobody reads the result, the check did nothing. Stripe's documentation says a failed CVC or postal code check can indicate a fraudulent payment, so review it before you fulfil the order. Not every mismatch is fraud. Stripe notes that a customer who moves without telling the card issuer may fail the address check, and that AVS support varies by country and issuer: some countries do not use postal codes, and some issuers do not verify street addresses.
Related checks for card-not-present sales: Fraud screening without killing good orders · What is 3-D Secure 2?
Setting rules for small, mid-size and enterprise businesses
Small businesses that key phone orders into a virtual terminal or send payment links usually rely on the processor's default settings. Ask three questions: are AVS and CVV checks switched on for my account, what happens by default when a check fails, and can I change that? A simple house rule works: do not ship or hand over goods on a CVV no-match, and call the customer before fulfilling a high-value order with an address mismatch. Mid-size online stores can set gateway rules with three outcomes. Decline on a CVV no-match, send a street address mismatch with a matching ZIP to manual review, and do not decline foreign cards just because the issuer does not support AVS. Stored-card and recurring charges need their own rule: card networks do not allow merchants to keep the security code after authorization, and Braintree notes that vaulted payment methods return CVV not provided, so blocking on that result would stop your own subscriptions. Enterprise teams with API integrations should log the raw AVS and CVV result for every authorization, map each acquirer's codes to one internal set when they use more than one processor, and route results to a review queue rather than hard-coding declines. A sudden rise in CVV no-matches can point to card-testing, which is where velocity rules help. Whatever your size, change one rule at a time and watch both fraud disputes and the good orders you turn away.
Setting up phone and link payments: Keyed-in card payments: what to check · Pay by link: how payment links work
Keep the results: they can support a dispute response
Response codes are also records. In its compelling evidence examples for delivered goods, Visa's guide lists proof that the item was delivered to the same address where AVS matched, when applicable. Among the steps it suggests to help prevent fraud disputes, it lists enabling AVS and CVV2 checks where your acquirer supports them, together with 3-D Secure and watching for billing and shipping mismatches. Visa is clear that evidence is not a remedy and the issuer still decides the dispute, but an order record that holds the AVS result, the CVV result, the authorization result and the delivery proof is far easier to defend than a sale with none of them. Store the results, never the security code itself.
Key takeaways
- AVS checks the billing address; CVV checks the security code on the card
- The result comes back with the authorization, and an approval does not mean the checks passed
- Letters and labels differ by gateway: map your own list before writing rules
- Use three outcomes, decline, review or accept, instead of blocking every mismatch
- Keep the results with each order: an AVS match plus delivery proof can support a dispute response
Related guides
Sources
Want this checked against your own statement?
We are an independent agent — we shop every processor we work with and bring you the best deal for your profile. Free analysis, every fee named, back, usually within 4 hours. Or call now and we will quote you on the phone.