Why do we have to manually cancel orders that have come in with AVS = NO, which means the billing address does not match what address the financial institution has on file. That should be an automatic decline from the payment processor to prompt the customer to use different info or a new payment method. Instead the order went through and now we are on a wild goose chase trying to confirm with the customer if it was an error or actual fraud. Cancelling an order and having them reorder is a pain. It would make more sense to make them do it right there and then.
Topic summary
A merchant is experiencing issues with Shopify’s fraud prevention settings not blocking orders that fail AVS (Address Verification System) checks. Despite having the “Decline charges that fail AVS postal code verification” setting enabled in their payment gateway configuration, an order was processed even though:
Failed verification details:
- AVS result code: N (complete mismatch)
- Both street address and postal code failed to match
- Card issuer: JP Morgan Chase
- Fraud risk score: 39
The merchant questions why they must manually cancel these high-risk orders instead of having them automatically declined at checkout, which would prompt customers to correct their information immediately.
Possible explanations suggested:
- AVS codes are more complex than simple pass/fail, with multiple result types depending on the issuing bank
- The setting may have been enabled after the order was placed
- Potential bug in Shopify’s AVS code interpretation
Current status: The issue remains unresolved. The recommendation is to open a support ticket with Shopify, including the order number and checkout settings for investigation. The specific payment gateway used has been requested for further troubleshooting.
Hi @Dee_eComm1
I believe you can enable AVS matching as a requirement for accepting payments to your checkout.
This setting is under the Payments section in your store’s settings:
Then click Manage next to your payment gateway, then you should see a Fraud prevention section.
Within that section there should be a checkbox for Decline charges that fail AVS postal code verification.
Enabling that should require new transactions to pass AVS verification in order for Shopify to process them. Any failed billing address to actual credit card registered address should be rejected before the order is created.
Hope this helps
@dylanpierce That is very helpful to know, thanks Dylan! I checked an it was apparently already on! Now I am confused, then why did it let the order pass through? See screenshots below could it be a bug?
So AVS is a bit more complicated than a pass/fail result.
There’s actually several different codes and they depend on the issuing bank of the card.
Using the Shopify API you can find the actual AVS code and the bank issuing the card, but it’s not available in the order details page in the admin area.
Do you happen to know the issuing bank of the card and the actual AVS code for this transaction? Those two pieces of info are important to understand why it was allowed.
HI @dylanpierce yes this is info from the gateway:
Avs result
Code
N
Message
Street address and postal code do not match. For American Express: Card member’s name, street address and postal code do not match.
Street match
N
Postal match
N
“risk_assessment” => {“score” => 39, “reasons” => [“PROFILE_ENTITY”]}}]
Bank was JP Morgan Chase
Perfect thanks @Dee_eComm1
Those look like non-passing codes to me too.
Sounds like there’s either an issue with the Shopify AVS interpretation of codes, or potentially the AVS verification requirement setting was enabled after this order was placed.
I’m not sure if other staff/collaborators have access to your payment settings, but that might be an explanation.
It might take some time to escalate but it’s worth opening a support ticket with Shopify about this, make sure to include the order # and the Checkout settings.
Last question - which payment gateway was used for this order?