AVS Mismatch: What It Means and How to Fix It

Short answer: An AVS mismatch means the billing address entered at checkout did not match the address your card issuer has on file. The check compares the numbers in the street address and the ZIP or postal code. It is not proof of fraud: the issuer can still approve the payment, and many mismatches come from typos or old addresses.

This guide has two parts. The first is for shoppers whose card was declined. The second is for store owners deciding what to do with AVS results, with a full code table and a recommended action for each code.

What does AVS mismatch mean on a credit card?#

AVS stands for Address Verification Service (some processors say Address Verification System). When a store sends your billing address with a card payment, your card issuer compares it with the address on your account and returns a one-letter result code. "AVS mismatch" means that code said the address, the ZIP, or both did not match.

Three facts explain most of what you will see:

• Only the numbers are compared. The processor TabaPay's developer docs say: "Only the numerical portion of the address is verified by the issuer during an AVS check." For "123 Main Street, 55555", that means 123 and 55555.
• AVS is strongest in a few countries. Stripe's docs say: "Most cards issued in the United States, Canada, and the United Kingdom support street address verification." Elsewhere, the result is often "unavailable" rather than a match or a mismatch.
• A mismatch does not stop the payment by itself. Stripe says "A card issuer might still consider a payment that fails CVC or postal code verification legitimate, and therefore approve it." The decline you see usually comes from a rule the store or its gateway chose.

What does it mean when a card is rejected by AVS?#

It means the store or its gateway has a rule that declines a payment when the address check fails, or when the issuer could not check it. The issuer may have approved the money, and then the gateway cancelled the payment because of the AVS code.

Authorize.net is a clear example. Its support article lists the codes its gateway rejects by default: B, E, G, N, R, S and U. Some of those are true mismatches (N), but several only mean the check could not be done: R ("Retry, System Is Unavailable"), S ("AVS Not Supported by Card Issuing Bank") and U ("Address Information For This Cardholder Is Unavailable"). Merchants can change those settings, but many never do.

Why is my card getting declined but I have money?#

Because a card decline is not only about your balance. The issuer, the network, the gateway and the store all get a say. The most common reasons on an online order:

Only your issuer can tell you for certain why it declined. The store usually sees just a code.

Why does AVS fail when my address is correct?#

This is the "avs mismatch but address is correct" problem. The usual causes:

1. The issuer has an old address. You moved and updated the store, but not the bank. Stripe gives this exact example: "a customer who enters their address incorrectly or moves without notifying their card issuer."
2. The numbers differ. Because only digits are compared, an apartment or suite number typed into the first address line can change the digits the issuer sees. Try the address exactly as your statement shows it, with the unit number where your bank puts it.
3. You used the shipping address. AVS checks the billing address. A gift sent to someone else is fine, but the billing fields must hold the card's address.
4. A nine-digit ZIP mismatch. Some issuers match on ZIP+4. Try the five-digit ZIP.
5. Your card is from outside the US, Canada or the UK. Your issuer may not support the check at all, and some gateways decline "not supported" by default.
6. The store sends only the ZIP. Then the street line is never checked and a ZIP typo is the only possible cause.

Will I be charged after an AVS decline?#

You may see a pending charge for a failed order. Authorize.net explains that when its gateway declines a payment for AVS, "the authorization code and the hold on the authorized funds remain on the customer's card." The hold is not a completed charge. It stays until the issuer removes it, and Authorize.net says "Most card issuing banks will remove authorizations within 3-7 days if they are not claimed for settlement." The store cannot release it; your bank can.

Are AVS and CVV the same?#

No. They are two different checks that run on the same payment.

Stripe's view is that CVC checks are a strong signal because the code cannot be stolen from a store's database. But neither check protects against a thief who has the physical card or a full set of stolen details.

Is AVS mandatory?#

No law requires AVS. It runs only when the store collects the billing address and sends it with the payment. Stripe puts it plainly: "If no information is collected, the card issuer can't perform a verification check."

What to do with the result is also the store's choice. Chase's guidance for its merchants says an automatic decline on AVS alone is the business's decision, and that the amount, shipping address, CVV result and 3D Secure should be considered too.

Every AVS code, and how processors differ#

Here is the full letter code table for Visa, Mastercard, Discover and American Express, as PayPal publishes it for its Orders v2 API, next to Authorize.net's description of the same letter.

What we found comparing the two lists: Authorize.net's article lists 13 codes. Of those, 9 have the same meaning in PayPal's table, 1 is close (G), and 3 mean something different (B, E and P). PayPal lists 5 more letters, mostly for international cards. Chase's own table, which splits meanings by card network, differs again in places. So the letter alone is not enough: always read it with your own gateway's code list.

Stripe hides the letters. Its API reports address_line1_check and address_postal_code_check on the card, each one of pass, fail, unavailable or unchecked. That is easier to act on, and it keeps "no data" (unavailable) apart from "wrong data" (fail).

How we built this table: we copied each code from PayPal's "Card decline errors" page and Authorize.net's AVS support article on 29 October 2026, then compared the meanings letter by letter.

What should a store do with each AVS result?#

Group the codes by what they tell you, then decide by order risk. The table below is our own guidance, based on the code meanings above and the advice in Chase's and Stripe's merchant docs. It is a starting point, not a rule from any card network.

Why not decline every mismatch?

• Real customers fail AVS. Stripe says "AVS checks can fail for legitimate payments." A blanket decline turns away people who just moved.
• "Unavailable" is not "wrong". Authorize.net's defaults reject R, S, U and G. Its own article says most international card issuers do not support AVS, and that G, S and U "can be used to accept international credit cards." Leave those defaults and you decline many good foreign cards.
• Context beats one code. Chase's merchant guidance is to approve when AVS and CVD match, review partial matches and suspicious combinations, and hold and verify a partial match on a large order.

A practical setup for most stores:

1. Collect the full billing address for card payments, not only the ZIP, so the issuer can check both parts.
2. Turn on the CVV check in your gateway. A CVV failure is a stronger signal than an AVS failure.
3. Do not hard-decline "unavailable" results (U, S, G, R). Score them instead.
4. Use your gateway's softer rules if it has them. Stripe Radar's newer built-in rules block on a failed postal code or CVC check "unless Stripe evaluates it as low risk"; the older rules block every failure. WooPayments' Advanced fraud protection has an "AVS Mismatch" rule that, in WooCommerce's words, blocks orders "if the two don't match" and warns that "AVS checks may not be effective depending on the countries you sell to."
5. Hold high-value mismatches for a look rather than declining or shipping blindly. Contact the customer from the email or phone on the order.
6. Write your rule down and check it every few months against the orders it declined and the disputes you still received.

How AVS fits with other fraud signals#

AVS is one signal among many. On its own it neither stops card testing nor proves a customer is real.

Card testers, in particular, are after one thing: whether a card number works. Address checks do not count attempts or failures, which is why card-testing protection works on attempts and failures, not on address results.

How ChargeWarden uses AVS and CVV results#

ChargeWarden reads the risk data your WooCommerce payment gateway already saves on the order and turns it into scored, written reasons. What it reads depends on the gateway, as listed in Gateway risk data:

ChargeWarden does not run its own AVS check and does not read Stripe's raw AVS values. It uses what the gateway decided.

Here is how that plays out with the default points in Order risk scoring. "Gateway: review" is worth 25 points and the review band starts at 40, so an address mismatch alone does not stop an order:

That is the approach this guide recommends: a mismatch counts, but it is weighed with everything else. Every point is shown with its reason, and the review queue gives one-click approve or reject. You can change any rule's points.

ChargeWarden also stops card-testing attacks on the classic checkout and the Store API, which address checks do not touch. See scored orders on the live demo, compare it with other tools in WooCommerce anti-fraud plugins compared, or buy ChargeWarden.

Related: Stripe Radar for WooCommerce, friendly fraud and SAQ A explained.

This guide is general information, not payments or legal advice. Code meanings are as published by PayPal, Authorize.net, Chase and Stripe on 29 October 2026; your gateway's documentation is the authority for your account. Visa, Mastercard, Discover, American Express, PayPal, Stripe, Authorize.net, Chase and WooCommerce are trademarks of their owners. PluginLoom is not affiliated with or endorsed by any of them.