Credit Cards: Can AVS be checked before Authorization?

Credit Cards: Can AVS be checked before Authorization?

Explore the sequence of Address Verification System (AVS) checks and authorization in credit card transactions, understanding the technical and practical implications for fraud prevention.

When processing credit card transactions, merchants often rely on various tools to prevent fraud. Two critical components are the Address Verification System (AVS) and the Authorization process. A common question arises: can AVS be checked independently or before the actual authorization? Understanding the typical flow of these checks is crucial for designing secure and efficient payment systems.

The Standard Transaction Flow

In most credit card processing systems, AVS is not a standalone check that can be performed entirely before an authorization request. Instead, AVS is typically an integral part of the authorization request itself. When a merchant submits a transaction for authorization, they include the cardholder's billing address information (street number and zip code) along with the card details, amount, and other transaction data.

sequenceDiagram
    actor Merchant
    participant PaymentGateway as Payment Gateway
    participant Acquirer as Acquirer Bank
    participant Issuer as Issuing Bank

    Merchant->>PaymentGateway: Authorization Request (Card Data, Amount, AVS Data)
    PaymentGateway->>Acquirer: Forward Authorization Request
    Acquirer->>Issuer: Forward Authorization Request
    Issuer-->>Issuer: Perform AVS Check (Internal)
    Issuer-->>Issuer: Perform Funds Check (Internal)
    Issuer-->>Acquirer: Authorization Response (Approval/Decline, AVS Result Code)
    Acquirer-->>PaymentGateway: Forward Authorization Response
    PaymentGateway-->>Merchant: Forward Authorization Response

Standard Credit Card Authorization Flow with AVS

As shown in the diagram, the AVS check is performed by the issuing bank (or sometimes the payment processor on behalf of the issuer) as part of the authorization process. The result of the AVS check (e.g., full match, partial match, no match) is then returned along with the authorization decision (approved or declined) in a single response.

Why AVS is Tied to Authorization

There are several reasons why AVS is typically bundled with the authorization request:

1. Efficiency: Combining these checks into a single request-response cycle reduces latency and the number of network calls, streamlining the transaction process.
2. Data Security: Sending sensitive cardholder data (like address) separately from the card number for an AVS check, and then again for authorization, could introduce additional security risks or require more complex tokenization schemes.
3. Fraud Prevention Logic: The AVS result is often a factor in the overall authorization decision and subsequent fraud scoring. A mismatch might lead to a decline or a higher fraud risk score, even if funds are available. The issuer's fraud detection systems use AVS results in real-time to make informed decisions.
4. Cost: Each separate transaction or inquiry can incur a fee. Bundling AVS with authorization is generally more cost-effective.

Practical Implications for Merchants

For merchants, this means that you generally won't get an AVS result without also attempting an authorization. If you want to use AVS as a primary fraud filter, your system should be configured to interpret the AVS response codes returned with the authorization. For example, you might:

• Automatically decline transactions with a 'no match' AVS response.
• Manually review transactions with a 'partial match' AVS response.
• Only ship to the billing address if AVS returns a 'full match'.

Some payment gateways offer 'AVS-only' or 'zero-dollar authorization' transactions, but these are still authorization requests (often for a nominal amount like $0 or $1) that include AVS data. Their primary purpose is to validate the card and address without actually charging the customer, but they still follow the authorization flow.

{
  "transactionType": "AuthOnly",
  "cardNumber": "************1111",
  "expirationDate": "12/25",
  "amount": 100.00,
  "currency": "USD",
  "billingAddress": {
    "street": "123 Main St",
    "zip": "90210"
  }
}

Example of a simplified authorization request including AVS data