Understanding AVS & CVV Declines & Authorizations
We often get questions from merchants, inquiring about a transaction that shows as declined at the payment gateway, yet the customer is calling asking: “Why was my credit card billed?”
In this scenario, the answer is that the customer’s card was “not” billed. Instead, an “Authorization” has been placed on their card (which if the customer uses a debit card may seem to them to be the same as a “charge” since it lowers their available spending limit).
This situation only comes into play if you have enabled AVS (Address Verification System) or CVV (3 digits on back of card) rules to help protect your merchant account from fraudulent transactions (and to possibly help win chargeback disputes).
What has occured here, is that the processing bank sent the request to charge the customer’s card, and initially an authorization was approved, but, secondarily, the AVS or CVV rule failed, so the payment gateway declined the transaction.
While this can create confusion for your customer, the process is in place to protect you the merchant. Understanding how the gateway handles AVS & CVV responses will help you better communicate with your customers.
How a payment gateway handles authorizations & AVS/CVV declines:
- When a transaction is sent to the bank, it first “authorizes” the card for the amount requested (to verify if it is a valid card number and the requested amount is available). The AUTHORIZATION is approved, regardless of what the AVS/CVV response from the bank is.
- Secondly, the AVS/CVV response is sent back to the gateway along w/ the authorization.
- There is a difference between an “authorization” and a “capture”, normally the gateway will authorize & capture at the same time. However, if you have your gateway settings to DECLINE transactions that don’t match AVS or CVV, then the gateway will not capture the authorization if the AVS or CVV response that is received secondarily is NO MATCH. So, if the CVV or AVS fails after the authorization, the customer will see the “authorization” on their card, and you will see a “Declined” transaction in your gateway reports.
- Authorizations reserve (ear-mark) the funds for the merchant for 7-10 business days. For example, when you check into a hotel on Friday night, the hotel authorizes funds on your card, but doesn’t capture them until you check out (that’s why hotels have signs at the front-desk that state “Do Not Use Your DEBIT Card for Check-In”). What your customer is seeing on their online statement is a “pending charge” (ie, authorization), that will automatically fall off of their account in due time (5-10 business days depending on the card issuing bank), but it was never captured because you told the gateway not to accept transactions that don’t meet your AVS or CVV rules. Explain to the customer that you use AVS & CVV to help protect yourself from fraud & chargebacks, and that the AVS/CVV response is unfortunately not known until AFTER the authorization is processed.
- There is no “refund” or “chargeback” that can occur on an authorization like this. Further, there is “no” transaction to reverse since the transaction was rejected for no AVS/CVV match. Some card issuing banks (Capital One, HSBC etc) may let you CANCEL a pending authorization, but you must call into the card issuing bank with the customer to do this (since the authorization is to protect merchants, the banks won’t let customers cancel the authorization without confirming with the merchant); we can’t guarantee they will cancel the authorization though, and there is no way to cancel an authorization on your end. If you explain to the customer that this is only an authorization, and will automatically fall off of their card shortly, they should hopefully understand. To bill the customer please obtain the correct Address or CVV and run a new sale, or have the customer go through checkout again with the correct information or a different card.
If you are going to employ AVS or CVV rules to help filter out fraudulent sales, we recommend that merchants add a statement along these lines during their checkout process: “TO PREVENT FAILED TRANSACTIONS, BE SURE TO ENTER YOUR BILLING ADDRESS EXACTLY AS YOUR CREDIT CARD COMPANY HAS IT ON FILE”
One other note on AVS settings: your customer may insist that they have given you the correct billing address, but unfortunately customers aren’t always right. If the response at the gateway states that the address does not match, that is the specific AVS response that the card issuing bank reported. The payment gateway does not “create” these AVS responses; the gateway simply sends the address to the card issuing bank, and the card issuing bank responds if it matches or not. The gateway has no control over the AVS response from the card issuing bank; the customer will need to call their bank to verify the address on file.
If you have any other questions, please contact your dedicated Durango-Direct.com account manager. If you are stuck processing with some dinosaur of a bank that doesn’t have informative articles or dedicated account managers (what a shame!) apply today for a free quote!