When a card payment is submitted to your customer’s card issuer for authorization, Stripe provides the CVC, ZIP code, and billing street address for them to verify (if collected). The card issuer checks this against the information they have on file for the cardholder. If the provided information doesn’t match, the verification check fails. A failed CVC or ZIP code check can indicate the payment is fraudulent, so you should review it carefully before fulfilling the order.

Each Charge object includes the verification response as part of its source attribute. You can also find the verification results in the Dashboard when viewing a payment.

If no information is collected, the card issuer cannot perform a verification check. It’s strongly recommended to collect the CVC, ZIP code, and billing address for every payment. The results of verification checks help improve the detection of potentially fraudulent activity.

Card verification code check (CVC)

The CVC (also referred to as CVV) is the three- or four-digit number printed directly on the credit card, usually either on the signature strip or the front of the card. Radar includes a built-in rule to block any payments that fail the CVC verification check (note that this does not affect payments where the CVC check could not be performed). This can be enabled or disabled within the Dashboard.

In general, only cardholders in physical possession of the card should have access to the CVC number. Businesses are not permitted to store the CVC number, so it’s unlikely that a fraudster can obtain this information through a computer breach. However, CVC verification does not protect against physical theft of a card, or card information used on a compromised computer or website that isn’t secure.

Address verification (AVS)

AVS is comprised of two checks: one based on the ZIP code and another based on the billing street address. AVS checks determine whether these pieces of information match the billing address on file with the card issuer. Radar includes a default rule to block any payments that fail ZIP code verification, which can be enabled or disabled within the Dashboard.

There are situations where these address checks can fail on legitimate payments. For example, a customer entered their address incorrectly, or has recently moved and not yet updated their address with their card issuer.

Support for both AVS checks varies by country and card issuer (e.g., certain countries do not use a postal code or some card issuers do not support street address verification). However, street address verification is commonly supported for cards issued in the United States, Canada, and the United Kingdom.

Next steps

Now that you have learned about how to make use of verification checks, you may want to learn about some of the best practices in preventiong fraud, or move on to related subjects:

• Best Practices for Preventing Fraud
• Types of Fraud
• Identifying Fraud

If you require assistance with a dispute, please contact Stripe support.