When shopping online in the U.S., many merchants verify the identity of the cardholder by verifying the credit card security code and AVS(Address Verification Service) to prevent credit card fraud.
These are several common forms of validation:
- Card number + Expiry date
- Card number + Expiry date + CVV2
- Card number + Expiry date + CVV2 + 3D verification
- Card number + Expiry date + CVV2 + AVS
The first method of verification
Use it often when booking airline tickets, hotel reservations, or car rentals because most of the time you’ll be taking your physical credit card to swipe your card on site or enjoy the services booked yourself. So airlines, hotels, and car rental companies are not particularly worried about credit card fraud and only need to provide the card number and expiration date to make a reservation.
The second method of verification
This is the method used by most e-commerce sites. The one exception, however, is Amazon, which only requires the cardholder’s name, card number, and expiration date when adding a credit card, and only verifies the card number and expiration date.
Many people think that e-commerce sites must require shoppers to provide their credit card number, expiration date, and correct CVV2 code in order to deduct charges, but they don’t, and e-commerce sites only need to know the card number and expiration date in order to deduct charges. I don’t know if you’ve noticed this when you shop on some sites, the first time you add a credit card, you need to provide your card number +Validity + CVV2. The e-commerce site will save your credit card information (some will be prompted, some won’t) for your next shopping purchase. However, according to the regulations of MasterCard and VISA organizations, e-commerce sites are not allowed to retain the CVV2 information of their customers, otherwise it is counted as a Violation. There are definitely some sites that secretly keep the cvv2 code of the customer’s credit card, but I believe most still follow the rules.So when you pay later, the e-commerce site will just deduct it from your credit card by card number + expiration date. Only if your IP address, computer, or phone changes and the e-commerce site deems the transaction risky will you be asked to provide the cvv2 for security verification.
Why doesn’t Amazon need a VCC code to deduct payments? A lot of people don’t get it. This is actually a risk management concession made by Amazon to make it easier for users to shop. If you’re a regular customer and the IP address or device (computer or phone) you use to shop hasn’t changed in a long time, Amazon will Trust you to have a good shopping experience so that you don’t have to go looking for your credit card’s CVV2 code from your wallet. Once you know this principle, it’s easy to understand under what circumstances Amazon will freeze your account and how to avoid triggering Amazon’s risk control system.
The third method of verification
This method is more common in Asian e-commerce sites, but not in Europe and the United States, because the credit card system and credit mechanism in Europe and the United States is very perfect, and the safety of funds is guaranteed. The 3D security authentication function greatly protects cardholders’ card security, improves customers’ confidence in online shopping, reduces the probability of refusal to pay (mainly malicious refusal to pay), and plays a protective role for both users and merchants.
Fourth verification method
Address Verification Service, which dramatically makes it harder for customers to place orders. Many times it causes customers to abandon their purchases. There are not many e-commerce sites that use Address Verification Service for verification, mainly is to prevent refusals to pay and to exclude some non-targeted customers.
For certain items with a high unit price, such as laptops, mobile phones, various designer bags, etc., some buyers will apply for refunds or chargebacks after receiving the goods with false reasons such as stolen credit cards. The refund situation isn’t bad yet, but chargeback hurts ecommerce sites more than refunds More than that, not only loss of goods, but also a high fee. So for orders that can’t go through AVS, the e-commerce site will just cancel and not take the business.
To prevent people from using virtual credit cards from outside the US to sign up for a free trial, some software companies use “card number + expiration date + CVV2 + AVS” for verification. Quickbooks, for example, was first available to sign up for a free trial using Entropay VCC, and then none of the virtual cards outside the U.S. could be signed up for because it was AVS enabled. This method worked, but it wasn’t perfect, and it was quickly discovered that you could sign up for a free trial using a virtual gift card. Because you can customize your billing address and zip code when using a virtual gift card, it passed AVS perfectly.
AVS works well and can help ecommerce sites win disputes, especially if the shipping address and billing address are the same, and the likelihood of a merchant winning a dispute is very high. In addition, credit card organizations offer discounts and lower fees to merchants who use AVS.
But AVS isn’t perfect, as in the following case.
A guy accidentally lost his wallet, which had all his credit cards as well as his driver’s license in it. This wallet was picked up by someone who was short on cash and was buying a new TV from an online store. The e-commerce site requires CVV2 verification as well as AVS verification, and the person who picked up the wallet has both, although the delivery address is different, but the person who picked up the wallet can call and explain that they just moved and haven’t had time to update their billing address, the merchant will accept the deal in most cases in order to make money. Some of you may have questions: don’t you have to provide identification and sign for it in person? In some cases it is required, in others it is not. Some U.S. courier companies put the package directly on the doorstep of the recipient, does not need to sign for it, a lot of loopholes, resulting in package theft, and finally unlucky is the merchant. This is one of the reasons why some people specialize in making illegal income from REFUND.
How does AVS work exactly?
AVS is known as the Address Verification System, which verifies the cardholder’s address by validating the the digital component to confirm the identity of the cardholder. Currently, only VISA and MasterCard credit cards issued in the United States, Canada, and the United Kingdom and American Credit cards issued by Express and Discover support AVS.
For example, if I enter the address 8345 NW 66 ST, MIAMI, FL 33166-2696 when shopping at Lenovo 8-Channel, AVS will compare the numbers 8345 and 33166-2696 with the address recorded by the card issuer and notify the merchant if the numbers match, thereby helping the merchant make the most informed decision regarding the authorized transaction. When the merchant requests AVS validation from the card issuer, the issuer returns a code to indicate the result of the AVS validation, and the merchant can use this code to decide whether to accept the transaction.
As long as the address or zip code is incorrect, credit card fraud can occur, but the merchant will generally not just cancel the order but will have customer service manually review the order and decide whether or not to accept the order. Because a mismatch between address and zip code is possible.
- Customers from countries other than the United States, Canada and the United Kingdom.
- The client has just moved and hasn’t had time to update his address.
- It is quite common for customers to enter wrong numbers or postcodes in the address.
And merchants can generally do the following.
- Call the customer and verify the phone number, billing address and address.
- Call the issuing bank, usually for three-way verification, and contact the customer at the same time. Use a search engine to search for related information about the customer, such as name, address, etc., kind of like social engineering.
- Compare with their own database, and if they are an existing customer, accept this order directly
Once you understand these principles, it’s easy to understand why Amazon only uses “card number + expiration date” for verification. Amazon’s order volume is so large that if every transaction had to verify CVV2 or even AVS, transaction costs would increase a lot and staff workload would increase exponentially, so Amazon does its own risk control system and doesn’t contact third parties (payment gateways, card issuing banks, etc.).
Here are a few risk warning signs
- Customers frequently change IP addresses when logging in to their accounts, increasing the risk index.
- Multiple account logins on different devices, such as new phones and computers
- Frequent use of new shipping addresses
- Frequent addition or deletion of different credit cards
- Sign up for a new account and make a large purchase
So, if you are planning to shop at Amazon, you can pay attention to the above details in order to prevent your order from being canceled. For e-commerce sites that use AVS verification, to prevent order cancellations, using a US credit card and a US shipping address is the best option, such as a BOA physical credit card. BOA credit cards allow you to change the billing address, you can change the billing address to your shipping address, so that the billing address and shipping address exactly match, which can greatly increase the chances of successful orders. When you pay with a virtual credit card, since most virtual credit cards have the same billing address, direct use of the virtual credit card’s billing address can easily be associated, and there is no way to solve this problem for merchants who must require an exact match of zip code and address. However, some merchants are only validating the zip code and not the address, which gives international shoppers a sliver of hope. You can use different addresses within the same zip code area to place an order, as long as the zip code is correct. For buying virtual goods, this is a great method.
If you use a U.S.-issued virtual credit card to verify PayPal, or if you buy a Google product, make sure the zip code is correct when you first add the credit card, otherwise, the verification will most likely fail.