Card security codes and ZIP checks: what they actually do

Does asking for the security code and ZIP make a card sale safe? Not by itself. CVV and AVS verification are two checks used mostly on phone, online, and keyed sales. The CVV check confirms the customer knows the security code printed on the card. AVS, the address verification service, compares the billing address numbers they give with what the bank has on file. Both help. Neither proves the person is the cardholder.

Here's what they actually do, and where they fall short.

What does the security code check confirm?

The card security code is the three- or four-digit number printed on the card. It goes by several names: CVV, CVC, CID, and others, depending on the brand.

When you ask for it on a phone or keyed sale, it's sent to the issuer with the transaction. The issuer checks it and sends back a result: match, no match, or not checked.

A match means the person knows the code on the card. That suggests they have the card or a photo of it. It doesn't prove they're the cardholder.

The code isn't stored in the card's magnetic stripe or chip data in the same way, and merchants aren't allowed to store it after authorization. So a thief who only has stolen stripe data may not have the code. That's why it's useful.

What does the ZIP or address check confirm?

The address verification service, or AVS, compares the numbers in the billing address the customer gives with the issuer's records. Most counter terminals ask only for the billing ZIP code.

The result comes back as a code: full match, ZIP match only, street match only, no match, or not available.

A match suggests the person knows the cardholder's billing address. Again, that's helpful, but addresses aren't secret. Stolen card data often includes them.

Some issuers, especially outside the US, don't support AVS at all. A "not available" result isn't necessarily a bad sign.

What don't these checks do?

They don't prove identity. A fraudster with a full stolen card record often has the code and the address.

They don't protect you from all chargebacks. A sale that passes both checks can still be disputed as fraud, and a card-not-present sale often leaves the merchant carrying the loss.

They don't matter much for chip or tap sales. When the card is present and read by chip or contactless, the chip itself is doing the verification. Asking for a ZIP on a chip sale is usually not needed.

And a mismatch doesn't automatically mean fraud. People mistype, move, or give an old ZIP. A mismatch is a reason to look closer, not to accuse anyone.

How should you use them?

Use them on every card-not-present or keyed sale.

1. Ask for the security code and billing ZIP on phone orders and keyed sales.
2. Look at the results your terminal shows. Know what match and no-match look like on your screen.
3. Set a simple rule for mismatches. For example, a manager decides on any no-match over a set amount.
4. For large first-time phone orders, confirm the name, call back on a listed number, and consider asking the customer to pay in person at pickup.
5. Never write down the security code. Enter it and let it go.

For counter sales, the best protection is still dip or tap. Keep your reader working so you rarely need to key a card.

If you're not sure what your terminal shows for these checks, ask the NRS Pay team. For readers that make chip and tap easy, see NRS Pay equipment.