AVS and CVV results in Recurly: a field guide for fraud and support teams
What the address and security-code check letters on a Recurly transaction usually mean, why they vary by gateway, and how to use them when you are looking at suspicious signups or a dispute.
Every card transaction in Recurly can carry two short results from the card network: an AVS result (did the billing address match what the bank has?) and a CVV result (did the security code match?). They are single letters, they are easy to ignore, and they are some of the most useful fraud signals you have.
One caution first. Recurly passes these results through exactly as your payment gateway returns them, so the letters can differ between gateways. The meanings below are the common card-network ones. Check your gateway's documentation for its exact list, especially if you use more than one gateway.
AVS: does the address match?
| Result | Usual meaning |
|---|---|
Y |
Street address and 5-digit ZIP both match. |
X |
Street address and 9-digit ZIP both match. |
A |
Street address matches; ZIP does not. |
Z |
5-digit ZIP matches; street address does not. |
W |
9-digit ZIP matches; street address does not. |
N |
Neither the street address nor the ZIP matches. |
U |
Address information is unavailable from the issuer. |
R |
The issuer's system was unavailable; try again. |
S |
The issuer doesn't support address verification. |
E |
Error, or address verification not allowed for this card type. |
G |
The issuer is outside the US and doesn't take part. |
B, M, P, C, D, I |
International variants: partial or full matches where the postal code or street could not be verified. |
Recurly notes that S is neither a pass nor a fail: the issuer simply doesn't check addresses.
CVV: does the security code match?
| Result | Usual meaning |
|---|---|
M |
The security code matches. |
N |
The security code does not match. |
P |
Not processed. |
S |
The card should have a code, but none was submitted. |
U |
The issuer doesn't support security-code checks. |
Reading them in context
AVS and CVV results mean more together, and in bulk, than on any one transaction:
- A CVV mismatch on a new signup is a strong signal on its own. The person may not have the card in front of them.
- CVV matches, but lots of declines. This is the pattern that surprises people. When someone is testing a list of stolen cards with complete details, CVVs match and the declines come from cards that have been cancelled, emptied or reported. Matching CVVs do not mean genuine customers.
- ZIP-only matches (
Z) clustered on one traffic source. Worth a look, particularly with shared IP addresses. UandSare common and usually harmless. Many issuers, especially outside the US, simply don't check.
Using them in a dispute
When a chargeback arrives, an M CVV result and a Y AVS result on the original charge are
evidence the cardholder's details were used correctly. Keep them with the dispute.
Seeing the pattern
In Claude or ChatGPT with Retrixus:
"For declined card checks on new signups today, break down the AVS and CVV results."
"Show me signups in the last 24 hours with a CVV mismatch, by traffic source."
"Compare AVS results on successful versus declined first charges this week."
Start free on one Recurly site, or read about spotting card testing.
Try it on your own Recurly data
Start free on one Recurly site. Connect Claude or ChatGPT and ask your first question in about 15 minutes.
Start free