AVS and CVV: The Card Checks Behind Online Payments (2026)

AVS and CVV are two verification checks performed by the card issuer during the authorization of a card-not-present payment. The Address Verification Service compares the billing address given by the buyer with the one on file. The CVV check compares the security code printed on the card with the value the issuer expects.

In 2026, these checks remain part of almost every online card payment, even where 3-D Secure and strong customer authentication apply. For PSPs, PayFacs and platforms, they are inexpensive signals that feed risk decisions, approval rates and dispute handling. Their limits are just as important: neither check authenticates the cardholder, and one of the two values can never be stored.

What are AVS and CVV?

AVS and CVV are data checks returned with the authorization response. They tell the merchant whether two pieces of information supplied at checkout match the issuer’s records.

The card verification code has several names. The PCI Security Standards Council’s glossary defines it as the three- or four-digit value printed on the front or back of a payment card, called CAV2, CVC2, CVN2, CVV2 or CID depending on the brand. This article uses CVV as the generic term. The code is not in the magnetic stripe or the chip, and it must never be stored, so in principle only someone holding the card can provide it.

AVS compares the postal code and the street address entered by the buyer with the billing address held by the issuer. It is a regional service. Stripe’s documentation on verification checks notes that most cards issued in the United States, Canada and the United Kingdom support street address verification. Elsewhere the issuer often returns "not supported".

The two checks were introduced decades ago, when mail and telephone orders grew and merchants needed some assurance without seeing the card. They were designed for a world where card numbers leaked through paper receipts, not through phishing sites and malware. This history explains both their wide support and their limits.

Both checks produce a result code, not a decision. The issuer can approve a payment with a mismatch, and the merchant or its PSP decides what to do with the result.

Related notions:

• Velocity check: a rule that counts events over a time window, such as attempts per card or per IP address.
• 3-D Secure 2 (3DS 2.0): the EMV protocol that lets the issuer authenticate the cardholder during an online payment.
• Frictionless flow: a 3-D Secure authentication completed without any action from the cardholder.
• SCA: strong customer authentication, required by PSD2 in Europe for most electronic payments.
• Sensitive authentication data: the PCI DSS category that includes the CVV.

AVS vs CVV vs 3-D Secure: how do the checks compare?

The checks answer different questions and carry different weight. AVS and CVV verify data. 3-D Secure authenticates a person.

• AVS: asks whether the address matches. It returns a code for the postal code and the street. It is useful mainly in the US, Canada and the UK.
• CVV: asks whether the buyer has the card details in hand. It returns match, no match or not processed. It is available worldwide, for customer-initiated payments only.
• Velocity check: asks whether this behavior is normal. It runs at the merchant, the PSP or the issuer, and needs no data from the cardholder.
• 3-D Secure frictionless: the issuer authenticates from data alone, with no action from the buyer.
• 3-D Secure challenge: the buyer confirms with a banking app, a biometric or a one-time code.
• Liability: a successful 3-D Secure authentication generally shifts fraud liability to the issuer. AVS and CVV results do not. Visa’s dispute management guidelines for merchants list them as fraud-prevention tools, not as a protection against disputes.

A typical AVS response distinguishes four cases: postal code and street both match, only the postal code matches, only the street matches, or nothing matches. Many merchants in the US accept a postal code match alone, because street formats vary too much. A CVV "no match" is treated more severely, since there is little reason for a genuine cardholder to mistype three digits twice.

The checks complement each other. A CVV match with a failed AVS on a shipment to a new address is a different risk from the same result on a digital subscription renewal. The interplay with authentication is covered in 3-D Secure and SCA exemptions.

How do AVS and CVV checks work?

The two checks travel inside the authorization request and come back in the response. The steps, from the checkout to the issuer and back, are:

1. Entry. The buyer types the card number, expiry date, CVV and, where requested, the billing address.
2. Capture. A hosted field or checkout component sends the data to the PSP, so the CVV does not touch the merchant’s servers.
3. Pre-checks. The PSP applies its own rules, including velocity checks on the card, device, email and IP address.
4. Authentication. Where required, 3-D Secure runs first. The issuer answers frictionless or asks for a challenge.
5. Authorization request. The PSP sends the request to the acquirer with the CVV and the address data. The acquirer forwards it through the scheme.
6. Issuer checks. The issuer validates the CVV, compares the address, checks funds and its own risk rules.
7. Response. The issuer returns approval or decline, plus separate result codes for CVV and AVS.
8. Decision. The merchant or PSP applies its policy: accept, review, or cancel an approved payment whose results are unacceptable. Cancelling means a reversal, as explained in authorization vs capture.
9. Deletion. The CVV is discarded once authorization is complete.

AVS and CVV in numbers (2026)

Recent data shows where card fraud happens and why data checks alone are not enough. Key figures:

• EUR 1.3 billion: card fraud in the EU and EEA in 2024, according to the EBA and ECB report on payment fraud published on December 15, 2025. Remote payments account for around 83% of it.
• 13 times: the fraud rate of remote card payments by value (0.091%) compared with in-person payments (0.007%), in the same report.
• 64% and 40%: share of electronically initiated card payments authenticated with SCA, by value and by volume. The rest relies on exemptions, where data checks matter most.
• Just under GBP 400 million: remote purchase fraud losses in the UK in 2024, up 11%, according to UK Finance’s Annual Fraud Report 2025.
• September 29, 2022: publication date of EMV 3-D Secure 2.3.1, the current version of the specification listed on EMVCo’s 3-D Secure page.
• November 27, 2025: date of the provisional agreement between the Council and the European Parliament on the Payment Services Regulation and PSD3.

What are the risks and limits of AVS and CVV?

Both checks are useful and weak on their own. Their limits come from how the data is obtained and how it may be used.

• Stolen data includes them. Phishing pages and compromised checkouts capture the CVV and the address together with the card number. A match proves the data is correct, not that the buyer is the cardholder.
• CVV cannot be stored. The PCI SSC states in its FAQ on card verification codes that they cannot be stored after authorization, even encrypted and even with the customer’s consent. Merchant-initiated payments therefore run without it.
• Not an SCA factor. The EBA’s opinion of June 21, 2019 states that card details and the security code printed on the card are neither a possession element nor a knowledge element.
• AVS coverage is uneven. Outside the US, Canada and the UK, many issuers do not support it. Formats and transliteration also create false mismatches.
• False declines. Strict rules reject real customers who moved, mistyped a postal code or use a company card. Lost sales can exceed prevented fraud.
• No dispute protection. A full match does not prevent a fraud chargeback.
• Velocity rules need tuning. Limits that are too tight block families and businesses sharing a card or a network. Limits that are too loose miss card-testing attacks, as described in velocity limits.

AVS and CVV: what changes for PSPs, PayFacs and platforms

Operators decide how the results are collected, exposed and used. Five areas matter.

Checkout and data capture

The CVV must be captured in fields hosted by a PCI DSS compliant provider and sent only for the authorization. Address fields should be requested where AVS is supported and skipped where it is not, since each extra field costs conversion. A smart checkout adapts the form to the card’s country. The article on best practices for a user-friendly checkout covers the trade-off.

Rules and routing

Result codes should be available as inputs to risk rules, per merchant and per market. A sensible default in the US, for example, differs from one in Germany. Country specifics are covered in our guides to payment methods in the United States and payment methods in the United Kingdom.

Authentication strategy

In Europe, the question is when to request an exemption and when to authenticate. AVS, CVV and velocity signals help estimate the risk of each payment. The blog article on 3-D Secure, SCA and delegated authentication and the #TheShot episode PSD2 and 3-D Secure: from fraud prevention to compliance explain how the framework evolved. The next step is described in our PSD3 episode.

Resilience and reversals

When an approved payment is rejected by the merchant’s rules, the authorization must be reversed quickly so the cardholder’s funds are released. When an acquirer does not return result codes, a fallback rule should apply. This belongs to payment resilience: every connection should behave predictably when data is missing.

Phone and mail orders

Telephone and mail order payments are card-not-present too, and the CVV is often read aloud. Agents should type it straight into a secure field or let the customer enter it on the phone keypad. Call recordings must pause or mask the digits. The differences between channels are explained in card-present vs card-not-present.

Disputes and evidence

Result codes are part of the evidence in a dispute, together with authentication data, device information and delivery proof. They should be stored with the transaction, unlike the CVV itself. The Payments Library paper Where is strong customer authentication for payments heading? discusses what comes after today’s factors.

Are AVS and CVV still worth using in 2026?

Yes, as signals and not as proof. They cost almost nothing, arrive with every authorization and help separate ordinary payments from doubtful ones. They do not authenticate anyone, they do not shift liability, and strict rules built on them reject good customers. What it means by player:

• PSPs: return CVV and AVS results in a normalized format across acquirers, and let merchants set rules per market.
• PayFacs: apply default rules per merchant category, and review false-decline rates as closely as fraud rates.
• ISOs: check that phone and mail order setups handle the CVV correctly, since it must never be written down.
• ISVs and platforms: request the address only where it adds value, and never store the code.

AVS and CVV check what the buyer knows about the card, 3-D Secure checks who the buyer is, and good risk decisions use both without mistaking one for the other.