Why Doesn't Shopify Payment Processor Decline Orders with Fraud Risk/ Low AVS Score

[Dee_eComm1]

Why do we have to manually cancel orders that have come in with AVS  = NO, which means the billing address does not match what address the financial institution has on file. That should be an automatic decline from the payment processor to prompt the customer to use different info or a new payment method. Instead the order went through and now we are on a wild goose chase trying to confirm with the customer if it was an error or actual fraud. Cancelling an order and having them reorder is a pain. It would make more sense to make them do it right there and then. 

[dylanpierce]

Hi @Dee_eComm1 

I believe you can enable AVS matching as a requirement for accepting payments to your checkout.

This setting is under the Payments section in your store's settings:

Then click Manage next to your payment gateway, then you should see a Fraud prevention section.

Within that section there should be a checkbox for Decline charges that fail AVS postal code verification.

Enabling that should require new transactions to pass AVS verification in order for Shopify to process them. Any failed billing address to actual credit card registered address should be rejected before the order is created.

Hope this helps

[Dee_eComm1]

@dylanpierce That is very helpful to know, thanks Dylan! I checked an it was apparently already on! Now I am confused, then why did it let the order pass through? See screenshots below could it be a bug?

[dylanpierce]

So AVS is a bit more complicated than a pass/fail result.

There's actually several different codes and they depend on the issuing bank of the card.

Using the Shopify API you can find the actual AVS code and the bank issuing the card, but it's not available in the order details page in the admin area.

Do you happen to know the issuing bank of the card and the actual AVS code for this transaction? Those two pieces of info are important to understand why it was allowed.

[Dee_eComm1]

HI @dylanpierce yes this is info from the gateway:  

Avs result
Code
N
Message
Street address and postal code do not match. For American Express: Card member's name, street address and postal code do not match.
Street match
N
Postal match
N

"risk_assessment" => {"score" => 39, "reasons" => ["PROFILE_ENTITY"]}}]

Bank was JP Morgan Chase

[dylanpierce]

Perfect thanks @Dee_eComm1 

Those look like non-passing codes to me too.

Sounds like there's either an issue with the Shopify AVS interpretation of codes, or potentially the AVS verification requirement setting was enabled _after_ this order was placed.

I'm not sure if other staff/collaborators have access to your payment settings, but that might be an explanation.

It might take some time to escalate but it's worth opening a support ticket with Shopify about this, make sure to include the order # and the Checkout settings.

Last question - which payment gateway was used for this order?