What is Address Verification Service (AVS) and how does it prevent marketplace fraud?

Address Verification Service compares the numerical street address and ZIP code submitted during checkout against the official records on file with the cardholder's issuing bank. In marketplace sales, fraud often involves stolen card numbers without accurate billing addresses. By checking these numeric components in real time, AVS flags unauthorized payment attempts before goods or funds are transferred.

Why does Address Verification Service only check numbers rather than full street names?

Card networks process millions of payment requests per second using standardized ISO messaging formats. Comparing full street names introduces text discrepancies like abbreviations, misspellings, or capitalization differences that cause false rejections. By stripping text and verifying only the numeric street digits and postal code, payment issuers achieve fast, reliable automated matching across global data systems.

Can a scammer pass an AVS check if they have a full stolen card identity package?

While sophisticated fraudsters sometimes acquire full identity details, including billing addresses, payment-layer AVS checks are only one barrier. When combined with broader identity verification signals—such as phone carrier history, device fingerprinting, and account age—inconsistencies quickly emerge. Multi-layered identity scoring catches synthetic accounts even when individual credit card details appear valid on paper.

Why do legitimate buyers sometimes fail Address Verification checks on high-value purchases?

Legitimate transactions can fail AVS checks due to recent address changes not yet updated with the issuing bank, simple typographical errors in postal codes, or formatting differences in apartment numbers. Additionally, international credit cards frequently do not support standard domestic AVS checks, returning system error codes that require secondary identity verification steps to resolve safely.

How does address verification differ from standard credit card authorization?

Credit card authorization checks whether an account is active and has sufficient credit or funds to cover the purchase amount. Address verification is an auxiliary risk check performed simultaneously that validates identity ownership by matching submitted address numbers. A payment can be authorized for funds while still returning a failed AVS match code.

How Address Verification Service Tech Stops Marketplace Scams

When you participate in high-value peer-to-peer transactions—such as buying a camera, selling a luxury watch, or settling a private sale online—payment authorization is only half the battle. A buyer's credit card can clear a balance check while still being completely fraudulent. As of August 2026, identity impersonation and payment fraud in private digital marketplaces continue to evolve, forcing platforms and participants to verify the human behind the transaction. At TrustMatch, we build identity verification technology that illuminates who is on the other side of a peer-to-peer transaction before money or merchandise changes hands.

To prevent bad actors from liquidating stolen financial credentials, payment processors rely on Address Verification Service (AVS) technology. Understanding how AVS operates at the data layer reveals why simple card authorizations fail to catch scams and how cross-referencing physical location data protects both buyers and sellers during high-stakes marketplace exchanges.

Understanding Address Verification Service: The Core Mechanism

Address Verification Service (AVS) works by comparing the numeric digits of a customer's billing address and ZIP code against the records stored by the card-issuing bank. It is a critical fraud signal because while criminals frequently steal primary payment card numbers and expiration dates from database breaches, they rarely possess the verified physical billing address tied to the cardholder's bank account. This discrepancy allows payment gateways to flag high-risk transactions before funds are settled.

When a buyer enters their payment details during a checkout process, the transaction request is packaged into an electronic data structure defined by international standards (such as ISO 8583). Within this message payload, the primary account number (PAN), expiration date, and security code (CVV) are combined with two specific billing address fields: the numeric portion of the street address and the postal ZIP code.

Consider how a standard street address is parsed by the system. If a cardholder lives at 742 Evergreen Terrace, Apartment 3B, Springfield, OR 97477, the AVS system strips away all alphabetic characters, spaces, and punctuation. It isolates two primary numeric strings: 742 (from the street line) and 97477 (from the ZIP code). The unit number 3B is evaluated separately or dropped entirely, depending on the issuing bank's parsing rules.

This numeric extraction is sent across the payment rail—from the merchant's gateway to the acquiring bank, through Visa, Mastercard, American Express, or Discover, directly to the issuing bank's database. The issuing bank performs an automated database query against the cardholder's account profile and appends a single-character result code to the authorization response returned to the merchant.

The Mechanics of AVS Signals and Response Codes

AVS generates specific single-letter response codes during payment processing to indicate the precise degree of alignment between submitted billing data and issuing bank records. This granular matching serves as an essential fraud signal because partial matches—such as a correct ZIP code paired with an incorrect street number—often indicate automated bot attacks or credential testing schemes. Card networks return these codes in real time so platforms can instantly evaluate risk before fulfilling high-value marketplace sales.

The card networks do not return a generic "pass" or "fail" for an address check. Instead, they issue standardized system codes that reveal exactly which numeric elements matched. Understanding these codes allows digital marketplaces to establish automated risk thresholds based on the exact level of data mismatch.

AVS Code	Street Number Match	ZIP Code Match	Assessed Risk Profile	Marketplace Fraud Implication
`Y` / `X`	Match	Match	Low Risk	High probability that the purchaser is the legitimate cardholder or possesses full account access.
`Z` / `P`	No Match	Match	Medium Risk	Common in legitimate relocations or misformatted street names, but can indicate partial credential theft.
`A` / `B`	Match	No Match	Medium-High Risk	Street address matches but postal code fails; often indicates outdated regional profile data.
`N`	No Match	No Match	Critical Risk	Neither element matches cardholder records. Strong statistical signal of stolen card credentials.
`U` / `R`	Unavailable	Unavailable	Uncertain Risk	Issuer system unavailable or card issued by non-supporting foreign institution. Requires secondary validation.

Why do payment networks strip text and focus strictly on numbers? Text matching across heterogenous banking databases is inherently fragile. A user might write "Street" while the bank record stores "St.", or spell out "Avenue" while the system expects "Ave". Numeric parsing circumvents natural language variations while preserving the distinct numerical signature of the home address and postal zone.

How Fraudsters Bypass Simple Checkout Checks (And Why AVS Stops Them)

Fraudsters bypass basic payment forms by exploiting checkout systems that only validate card numbers and expiration dates without enforcing address checks. AVS stops these scams by introducing an out-of-band verification layer where the transaction fails if the submitted billing numbers do not match the issuer's file. Because cybercriminals purchase stolen card data in bulk batches that usually lack full address profiles, enforcing AVS verification blocks illicit peer-to-peer marketplace purchases before physical goods are dispatched.

In cybercrime ecosystems, stolen credit card credentials are traded in bulk markets as "dumps" or "CVV pairs." A dump typically contains the raw card number, expiration date, and CVV code extracted via skimmers or digital phishing pages. Acquiring the full physical billing profile—known as "fullz"—requires significantly more effort and commands a much higher black-market price.

When a scammer attempts to purchase a high-value item on a peer-to-peer marketplace using a basic stolen card pair, they must enter a shipping address where they can retrieve the merchandise. If the marketplace platform does not enforce strict AVS matching, the scammer enters their drop-ship address into both the shipping and billing fields. The transaction processes, the seller ships the item, and weeks later the real cardholder files a chargeback, leaving the seller without the merchandise or the payment.

FTC report data from 2025 indicates that online shopping and peer-to-peer transaction fraud accounted for over $2.7 billion in reported consumer losses. According to a 2024 BBB study, stolen payment credentials were used in over 40% of fraudulent peer-to-peer merchandise sales. A 2023 FBI IC3 report revealed that non-delivery and non-payment scam losses surpassed $330 million across peer-to-peer trading communities. These statistics highlight why relying solely on basic account balances without location cross-referencing exposes peer-to-peer participants to severe financial loss.

How Address Verification Combines with Identity Scoring for Private Sales

Address verification provides strong payment-layer validation, but it becomes exponentially more powerful when fused with digital identity attributes like telecom carrier history and email age. This multi-layered signal combination is vital because sophisticated scammers may occasionally obtain a real billing address along with card details. Cross-referencing AVS results against phone line ownership and domain history exposes synthetic identities and ensures that the person making the purchase is genuinely connected to the payment method.

This is how the TrustCheck combined score uses this signal: by cross-referencing payment-layer AVS responses against external signals like telecom carrier records and email age to create a holistic trust profile. An address match on a credit card is a strong financial signal, but on its own, it cannot confirm whether the person operating the keyboard is the person listed on the card.

Verification Mechanism	Primary Signal Captured	Underlying Fraud Prevented	Blind Spot / Technical Limitation
Address Verification Service (AVS)	Numeric match between checkout address and card issuer records.	Stolen payment credential usage, unauthorized card testing.	Cannot confirm physical identity of the person initiating transaction.
IP Geolocation	Physical location estimated from IP routing tables and ISP data.	Cross-border relay attacks, obvious location anomalies.	Easily bypassed using commercial VPNs or residential proxies.
Telecom Identity Lookup	Line ownership, porting history, and carrier account status.	SIM swapping, temporary VOIP burner number abuse.	Requires current phone number input; subject to telecom data latency.
Device Fingerprinting	Browser canvas patterns, system hardware IDs, and OS configurations.	Automated botnets, multi-accounting scam scripts.	Privacy-focused browsers and device resets obscure signatures.

When an AVS check returns Code Y (Full Match), but the transaction originates from a brand-new VOIP phone number and a freshly registered email address, the multi-layered evaluation engine flags a high risk of identity takeover. Conversely, when a buyer's identity signals (phone line ownership history, real name consistency, digital footprint age) match the billing record returned by AVS, the platform can authorize the transaction with high confidence.

How Address Verification Works in Practice: Step by Step

The address verification transaction flow executes within milliseconds as data moves from a marketplace payment page through card networks to the issuing bank. This automated sequence is critical because it validates buyer authenticity at the exact moment of payment authorization without adding manual operational delay. By dissecting every stage of this transmission, platform operators and high-value sellers can understand precisely where fraud checks occur and how automated risk decisions are rendered.

Data Collection and Numeric Parsing: The checkout system captures the user's payment details and billing address. The application layer strips out all non-numeric characters from the street field and postal code, isolating the core digits (e.g., street number 1042 and ZIP code 90210).
Authorization Payload Construction: The payment gateway formats these numeric components alongside the credit card number, expiration date, transaction amount, and CVV code into an ISO-compliant authorization payload.
Interbank Transmission: The payload is securely transmitted through the merchant acquirer, over the card network infrastructure (VisaNet or Mastercard Network), directly to the card-issuing bank's authorization engine.
Database Query and Response Code Generation: The issuing bank performs an instant binary compare between the incoming numeric strings and the registered billing address associated with the account profile, assigning a single-character response code (such as Y, A, Z, or N).
Risk Policy Evaluation and Scoring: The authorization response and AVS response code are returned to the platform. The platform evaluates the code against its automated fraud rules and combines it with broader identity signals to render a final decision: approve, flag for secondary identity check, or decline.

Edge Cases, System Limitations, and Address Normalization

Address verification relies heavily on standardized data formats, making address normalization a necessary precursor to accurate risk evaluation. Format mismatches—such as soft typos, unit number omissions, or international formatting variances—can trigger false AVS rejections even for legitimate cardholders. System operators must understand these technical edge cases because misinterpreting a formatting error as payment fraud can needlessly disrupt legitimate peer-to-peer transactions while failing to catch actual cybercriminals.

One major technical challenge in address verification is the handling of multi-unit residential structures. If a cardholder's bank stores an address as 450 Main Street, Suite 200, and the checkout form inputs 450 Main St #200, proper software normalization must compress both inputs to the street number 450. If the normalization layer fails and packages 200 as the primary street number, the bank's automated match will return an incorrect mismatch code (Code Z or Code N).

To overcome these parsing discrepancies, modern address verification infrastructure employs CASS (Coding Accuracy Support System) software standards. Before sending data across the payment network, CASS normalizes variations in street names, directional indicators (e.g., "North" vs. "N"), and unit designations. This ensures that only true numerical values are submitted for issuer comparison.

International sales represent another distinct edge case. Outside North America and the United Kingdom, many international card issuers do not participate in automated AVS networks. When a foreign card is processed, the system frequently returns Code U (Unavailable) or Code G (Global/Non-US Issuer). In private marketplace sales, receiving a Code U does not prove fraud, but it indicates that the payment layer cannot confirm identity, necessitating out-of-band identity check workflows before releasing high-value merchandise.

Best Practices for Protecting Peer-to-Peer Marketplace Transactions

Protecting high-value peer-to-peer sales requires combining automated payment signals like address verification with pre-transaction identity checks. Relying solely on a single payment code leaves sellers vulnerable to account takeover scams or chargeback fraud once goods change hands. Adopting a unified verification workflow ensures that both the payment instrument and the physical identity of the individual behind the transaction are fully authenticated before any money or high-value merchandise changes hands.

When arranging high-value private sales, sellers and buyers should establish strict protocol safeguards. Never accept payment methods that bypass address validation, and avoid completing transactions where the shipping destination does not align with verified billing records without independent verification.

For platforms facilitating these exchanges, incorporating real-time address validation into payment gateways reduces chargeback risks significantly. When conducting high-value marketplace sales, performing a TrustCheck search alongside payment verification ensures that both the financial credentials and the person using them are authentic.

By understanding the underlying data structures, numeric parsing routines, and network signals that power Address Verification Service technology, participants in digital marketplaces can spot fraudulent patterns early, trade with confidence, and protect high-value assets against online payment scams.