AVS and CVV are two of the oldest fraud checks in online payments, and also two of the most misunderstood — neither one actually confirms who's holding the card, only pieces of information around it.
What AVS is really checking
Address Verification Service compares the billing address entered at checkout against the address on file with the card issuer — and it only checks the numeric parts, like street number and ZIP or postal code, which is why a customer moving or making a typo can fail a check despite being the legitimate cardholder.
What CVV is really checking
The CVV — the 3 or 4-digit code on the card — confirms the person paying is physically holding, or at least has seen, the actual card, since that number isn't stored on the magnetic stripe or chip and shouldn't be retained by merchants after the transaction.
Why neither one is a fraud verdict on its own
Both checks can fail for entirely innocent reasons, and both can be bypassed by a sufficiently prepared fraudster — which is why they're inputs into a broader risk decision rather than automatic approve or decline triggers by themselves.
Key takeaways
- AVS checks the numeric parts of a billing address, not the whole address.
- CVV confirms card possession at the time of entry, not cardholder identity.
- A failed AVS or CVV check has innocent explanations as often as fraudulent ones.
- Both work best as inputs to a broader risk score, not standalone pass/fail gates.