AVS Address and PO Boxes, Non-normal Addresses

AVS Address verification fails when using

[ooglek]

I use Payflow Pro in combination with the Vital payment processing gateway (now named something else). When customers sign up for our services, we make sure AVS ZIP and AVS ADDRESS are both correct.

Often for Addresses with PO boxes or multiple numbers in the address, AVS Address fails. This sucks, because customers can't sign up for our services. But if we turn AVS Address off, we have a higher fraud rate than with it turned on.

Have others found AVS Address to be inconsistent, even totally wrong? I've called up banks before to confirm billing addresses, and the address is exactly as the customer entered it, but the AVS Address still comes back as a failure.

A recent address that failed was "2135-4145 35th Street." I've seen "315 Main St Suite 37" fail, and multiple attemps with "315 Main St," 315, 31537 and Suite 37 all fail as well, though the bank confirmed the address as correct (I called personally).

[Conard]

Most bank employees have no idea that the billing address has to be changed in the AVS database when they change the billing address of a customer that moves.
Some smaller banks or branches don't even have access to make those changes and have to contact the card company that issued the card to make the changes.

In the bigger picture of things, these no match problems are just a small percentage of cases. In most cases maybe 1/4 of a single percent.

I contact the customer and tell them they have to call the toll free number on the back of the card and explain the problem to they CSR and get the address changed on their own.
Works 95% of the time and the rest are out of luck.

[ooglek]

Frustrating! Why wouldn't they banks make the AVS DB integrated with their billing system?!? Seems silly.

Do credit card companies send statements to PO boxes?

[Corey Bryant]

If the AVS fails you might want to consider looking into other options that might help you vet the transaction - maybe an autocall-back or VBV/MSC. The Quantum gateway has a number of interesting vetting methods, you might take a look at that to see if that could solve your problem.

CDGCommerce also offers VBV/MSC at no extra charge and that could help with some of the potential chargebacks. And enrolling in MSC will allow you to accept the Maestro card as well.

[ooglek]

So I'm back after 4 months. :-)

I'm not in a position to switch gateways, and I already have an inhouse system of doing phone verification. Maybe what I need to do is add a few more required pieces of information if the AVS Address check fails, basically a default one-step process but if AVS fails, add a second piece that gets a bit more information that can be verified.

I use MaxMind's MinFraud and they allow for the 800 number on the back of the card to be entered as a way to validate BIN + Toll Free number. I don't know how much I should trust that, especially since I accept payments from outside the US, and I believe the service to be very US-centric, understandably.

I can also do the phone verification and either require or at least score higher a phone number that is within the same area as the billing address. The problem is when the customer is out of town on business and wants to sign up for the service.

Suggestions on how to help retain people during the signup process while not turning them away with too strict of a policy, while still thwarting fraud, would be great.

[jdMorgan]

> Do credit card companies send statements to PO boxes?

I can answer this one, as my credit card statements have been sent to my PO Box for over 18 years. I live "out in the country" and the mail is delivered by a local person in a pickup truck. However, my house is so far off the main highways that in years past, mail delivery was far too unreliable -- The delivery person would make all kinds of excuses to avoid coming all the way down here -- Road too muddy, bumpy, dusty, long, etc. Also, the road didn't have a "government-approved" name or appear on maps until about eight years ago, and new delivery persons wouldn't know how to find us. So getting a PO Box in the nearest town was just a better solution.

I used to have trouble getting my card authorized because of different requirements for P.O. Box addresses and Zip code: "P.O. Box" versus "PO Box" versus "POB" etc. Also, our Postmaster insists that we use ZIP+4 with our PO Box number tacked onto the end. Since mine starts with a zero (e.g. 0123) and many card processors apparently drop that leading zero, that also caused problems. Most of those validation problems have been fixed, and the "text compare" used to validate cards is a lot smarter now.

Anyway, yes, credit card companies send statements to PO Box addresses.

Jim

[HRoth]

I have found the AVS is often worthless when it comes to addresses that have PO Boxes, numbered streets, street address with dashes in it, and so forth, so I don't have it set to reject any transactions if it fails. If I did, I would never be able to sell to anyone using a gift card or a foreign card. I used to use MaxMind, and I used to ask international cardholders for the phone number off the back of their card, but now I just go with my gut. I have also gotten rid of some widgets that attracted frauds. I get very little fraud now. No evil eye, I think it has been two years.

[Lightguy1]

From what I have been told AVS just checks for the numberical value in the field. For example, if your billing address is 1234 billings drive and you go to process it with 1234 fakeaddress dr it will pass AVS because the numerical value was the same.

[ooglek]

@jdMorgan -- thanks, that is useful information to know. I always thought you had to have a real physical address, but maybe that's just UPS and FedEx. :-)

@HRoth -- I'm going to remove the forceful denial of AVSADDR failures, but still flag the account for further review. I still use MaxMind, and after tweaking our acceptance of their ratings, we have very little fraud on several thousand transactions per month. Are you using something other than MaxMind now? I'm always interested in the real tools people use to thwart credit card fraud.

@Lightguy1 -- While you are correct in most cases, @HRoth is correct that PO Boxes, street names with numerical fields, dashes, apartment numbers, they all fly in the face of the usefulness of the AVSADDR matching. When it matches, it gives you just a hint more confidence that the transaction is valid; when it fails, the opposite is true.

Thanks for the replies folks -- greatly appreciated.

[ssgumby]

I believe there are varying levels of AVS. We have our set to match the numeric portion of street and the zip.

So 211 Main Street, Anytown, CA 90210 would match if they entered 211 This Street, ThisTown, CA 90210

[HRoth]

ooglek, I mostly just use my intuition now. I base it on what they are buying, how much they are spending, what they use for a screen name, and so on. If it's in the US, sometimes I will look up the phone number they give. I don't use any software anymore. I was being targeted for a while by a guy in Indonesia who would sit there and type in random cc numbers until he got a match, so I used the Fraud Suite on Authorizenet to stop isps. But then he quit trying so I dropped it.