The quick answer
CVV and AVS checks are used because a card number on its own proves nothing. Anyone who copies sixteen digits can type them into a checkout form. The CVV confirms the person has the physical card in hand, and AVS confirms they know the billing address the issuer has on file. Together they turn a bare number into something closer to proof of possession. Merchants run both because card-not-present fraud is expensive and the checks cost almost nothing.
What each check actually compares
AVS is a numeric comparison, not an address lookup. The merchant sends the street number and the ZIP, the issuer compares those against its own records, and a single-letter code comes back. Nothing gets stored on either end. CVV works the same way at a smaller scale: the three digits on the back of a Visa or the four on the front of an Amex get checked against what the issuer printed, and the answer is pass, fail, or not checked.
- AVS looks at the numeric part of the street address and the ZIP. Apartment letters usually get dropped before comparison.
- CVV2 and CVC2 are checks against the printed code. They are not the same as the CVV encoded on the magnetic stripe.
- Both return result codes to the merchant, and the merchant decides whether to accept, review, or decline.
- Neither check stores the data it verified. Card industry rules forbid retaining the CVV after authorization at all.
Why the word test shows up
Processors offer verification-only transactions: a zero-dollar or tiny authorization that runs AVS and CVV without moving money. Merchants use them to validate a card on file before a subscription renews, or to check a new payment method at signup. Finding out a card is bad before you ship is a lot cheaper than finding out after a chargeback lands.
Reading the result codes
- Full match. Street and ZIP both line up. Lowest risk, straight approval.
- ZIP match only. Common after a move or a typo in the street line. Many merchants accept and flag for review.
- Street match only. Rarer. Often an address change that has not reached the issuer yet.
- No match. High risk. Most merchants decline or step the buyer up to 3-D Secure.
- CVV fail or unchecked. A fail is serious. Unchecked usually means the issuer does not participate in verification.
What the checks cannot do
They do not tell you the card is funded, and they do not prove the person typing is the account holder. A stolen card paired with the right billing address passes both checks without complaint. That is why AVS and CVV sit alongside velocity limits, device fingerprinting, and 3-D Secure instead of replacing them. They raise the cost of fraud. They do not close the door.
If you are the cardholder
A decline tagged as an AVS mismatch almost always traces back to something boring: a recent move the issuer has not recorded, a hyphenated street name, or a ZIP typed wrong. Update the address with the issuer first, then retry. A CVV failure is different. If you are reading the digits off the card and it still fails, the card itself is the problem, so call the number on the back.