AVS mismatch, the response codes and the decline decision
An AVS mismatch means the billing address a shopper typed did not line up with the address the card issuer has on file. AVS, the Address Verification Service, checks two things and only two: the numeric part of the street address and the ZIP or postal code. When you see "AVS mismatch" on an order, one of those numbers did not match, and now you have to decide what to do with the order: accept it, decline it, or hold it for review.
That decision is the subject here. This is not the full fraud toolkit that weighs AVS alongside CVV, velocity, and device signals. It is the AVS-specific version: what each response code means, and how to make the accept-or-decline call without throwing away good customers.
What is an AVS mismatch?
The Address Verification Service is a check the card networks run during authorization. When you collect a billing address at checkout, your processor passes the street address and postal code to the issuer, and the issuer compares them against its records and returns a one-letter result.
The important limit is what it compares. AVS reads the numbers only. Chargebacks911's AVS explainer states it plainly: an AVS check "disregards the letters in the address provided, only comparing the numbers to the address on file," so the street name and city are "left unverified" (chargebacks911.com, checked 2026-08-10). For 123 Main Street, AVS checks 123 and the ZIP. Main Street versus Main St never enters into it.
Operators also get the mechanics wrong: the issuer usually authorizes the charge anyway. AVS is advisory, returned next to the approval, not a decline in itself. When an order gets rejected on AVS, that is your rule or your gateway making the call, not the bank. An AVS decline is a choice you own.
What do the AVS response codes mean?
The codes are single letters returned with the authorization. They are not perfectly standardized: Stripe, Chase, and Visa each publish their own list, and a letter can shift meaning between processors, so read your own processor's table before building rules on it. The common Visa domestic set, confirmed against Chase and Visa's acceptance documentation (chase.com and support.visaacceptance.com, both checked 2026-08-10), looks like this.
| Code | What it means | Suggested handling |
|---|---|---|
Y | Street address and 5-digit ZIP both match | Proceed. AVS is not a concern on this order |
A | Street address matches, ZIP does not | Low concern. Usually a typo or a stale ZIP on file |
Z | ZIP matches, street address does not | Review if other signals are weak. Common on moves and typos |
N | Neither street address nor ZIP matches | Review. Weigh against CVV, order value, and device before you ship |
U | Address information unavailable from the issuer | Cannot use AVS here. Lean on other signals, do not auto-decline |
S | Issuer does not support AVS | Same as U. Absence of a match is not a mismatch |
R | System unavailable or the request timed out, retry | Retry, then judge on other signals if it stays blank |
G | Non-US issuing bank does not support AVS | Expected on many international cards. Do not read as fraud |
A few codes sit outside that list. W and X are the nine-digit-ZIP versions of Z and Y, and E means the check errored or was ineligible for the card type. The letters matter less than the four buckets they fall into: full match (Y, X), partial match (A, Z, W), no match (N), and cannot verify (U, S, R, G). The partial and cannot-verify buckets are where merchants over-decline, because an unavailable result is not a mismatch at all.
Should you decline an AVS mismatch?
Not on the mismatch alone. A mismatch raises the odds an order is fraud, but plenty of real customers fail AVS for reasons that have nothing to do with a stolen card. Stripe's own guidance is blunt about it: AVS "checks can fail for legitimate payments," giving the example of "a customer who enters their address incorrectly or moves without notifying their card issuer" (docs.stripe.com, checked 2026-08-10).
Preventing the avoidable disputes is a separate lever, worth naming because AVS sees only one kind of risk. A mismatch flags a possible stranger on the card. It says nothing about the customer who bought the item, forgot the descriptor, and disputed weeks later. Screening waves that order straight through.
Geography makes the call harder. Stripe notes that AVS "support varies by country and card issuer," that some countries have no postal code, and that "most cards issued in the United States, Canada, and the United Kingdom support street address verification" (docs.stripe.com, checked 2026-08-10). Outside those three you often get G, U, or S, not a real match. American Express runs its own code set (F, H, K, L, and others), some codes limited to specific processors, per Visa's acceptance docs (support.visaacceptance.com, checked 2026-08-10). AVS is noisiest exactly where cross-border and Amex orders live.
A graded policy beats a blanket rule. Accept full and street-level matches when nothing else looks wrong, and route N and the cannot-verify results to review, weighed against the rest of your signals rather than the letter alone. That wider stack, and where each signal is blind, is the subject of chargeback fraud detection.
Does an AVS mismatch cause chargebacks?
Not directly. A mismatch is correlated with card-not-present fraud, which lands on Visa as reason code 10.4, card-absent fraud, but the mismatch does not cause the dispute. A criminal holding the full stolen billing address passes AVS cleanly, and a real customer with a typo fails it. AVS sorts weakly, in both directions.
Two things follow for the back end. First, AVS is thin evidence at representment. A passing AVS helps a little, and a mismatch is not proof of fraud you can lean on. On its own AVS shifts no liability, unlike 3D Secure, so it is a supporting detail in a case, never the case itself. When a 10.4 does land and you have the order history to fight it, Reclaim files the representment for you, and it is completely free: no install cost, no success fee, and you keep everything it recovers.
Second, the cost of a landed dispute does not care whether AVS matched. Each 10.4 counts toward your Visa VAMP ratio whether you win the representment or lose it, and carries a fee of roughly $15 to $25 or more on top of the lost goods. That is why AVS lives in the prevention layer: the cheapest dispute is the one that never files. Where AVS sits among deflection and representment is laid out in chargeback protection.
The honest part
AVS is a coarse instrument, and the edges are worth stating flatly.
It reads numbers only, so it is fooled both ways. A fraudster with the full billing address from the breach that leaked the card number passes it. A buyer who moved last month, or fat-fingered a ZIP, fails it. The check cannot tell those two apart.
The codes are not uniform. The same letter can mean different things on Stripe, Chase, or your gateway, and international and Amex results overlap awkwardly with the domestic set, so build rules from your processor's current list.
And AVS is not a liability shift. It informs a decision; it does not move fraud risk off you the way an issuer-authenticated 3D Secure transaction can. Treating a clean AVS as protection is how merchants get surprised when the 10.4 still lands.
Frequently asked questions
What does an AVS mismatch mean?
It means the numeric street number or the ZIP the shopper entered did not match what the card issuer has on file. AVS compares only those numbers, not the street name or city, so a mismatch tells you a number was off, not that the order is fraud. The issuer usually authorizes the charge anyway and leaves the accept-or-decline choice to you.
What is the difference between AVS code A and code Z?
Code A means the street address matched but the ZIP did not. Code Z is the reverse: the ZIP matched but the street number did not. Both are partial matches. A full match is Y, and N means neither matched. Codes like U, S, R, and G mean the issuer could not or does not verify the address, which is not the same as a mismatch.
Should I decline an order with an AVS mismatch?
Not on the mismatch alone. Real customers fail AVS through typos, recent moves, international cards, and Amex, where support is patchy. Decline every mismatch and you reject good orders to stop a fraction of fraud. Route no-match and unavailable results to review, and weigh them against CVV, order value, device, and history rather than the AVS letter by itself.
Does AVS work on international cards?
Often not. Stripe states that most cards issued in the US, Canada, and the UK support street verification, while support varies elsewhere and some countries have no postal code at all. Non-US issuers frequently return codes like G, U, or S, meaning AVS could not verify the address rather than that it mismatched, so declining on those results rejects legitimate foreign customers.
The check to run on your own AVS data
Pull last quarter's orders you declined or canceled where AVS was the deciding factor. For each, ask how many otherwise looked clean: a returning customer, a matching CVV, a normal basket, and a result that was a partial or an unavailable code rather than a flat N. That pile is your false declines, and it is usually larger than operators expect.
Then pull your 10.4 fraud chargebacks and check the AVS result each one carried. If most fraud that actually disputed had passed AVS, tightening the rule buys little and costs real sales. Read together, the two piles tell you whether your decline threshold is set to your own orders or to a default that never saw them.