Understanding AVS & CVV Declines & Authorizations
- Brad Jess
Why was a customer's card billed even though it shows declined?
AVS & CVV Declines & Authorizations: Tips & Tricks For Credit Card Merchants
Have you ever run a card, had it decline, yet it still shows up on a customer’s card statement? We often get questions from our high risk merchants, inquiring about a transaction that shows as declined at the payment gateway. The frustrated customer calls asking: “Why was my credit card billed?” This type of scenario is almost always due to AVS & CVC decline and authorization settings.
In this scenario, the payment gateway actually didn’t bill the customer’s card. Instead, an “authorization” has been placed on their card. If the customer uses a debit card, this will function very similar to a “charge” since authorizations do lower their spending limit.
These types of authorizations only happen if you have enabled AVS (Address Verification System) or CVV (3 digits on back of card) rules to help protect your merchant account from fraudulent transactions (and to possibly help win chargeback disputes).
Here’s how this works: The processing bank sent the request to charge the customer’s card. Initially the bank approved the authorization. However, during the second step, the AVS or CVV rules failed, so the payment gateway ended up declining the transaction.
Although these types of authorizations and holds can frustrate your customer, the process protects you, the merchant. Explain to the customer that you use AVS & CVV to help protect yourself from fraud & chargebacks. The AVS/CVV response is unfortunately not known until AFTER the authorization is processed. The authorization should be lifted automatically in 5-10 business days. You can assure your customer if this isn’t the case after a few week, you’ll be happy to contact your merchant services provider and resolve the issue.
Let’s deep dive into the payment gateway so you can better communicate with your customers the reason for these holds.
How a payment gateway handles AVS & CVV authorizations & declines:
Step 1: The merchant swipes the card and the payment is authorized.
First, when you swipe a customer’s card, the bank “authorizes” the card for the amount requested. The issuing bank verifies if it is a valid card number and if the requested amount is available. This authorization is approved, regardless of what the AVS/CVV response from the bank is.
Step 2: The AVS & CVV rules kick in for added fraud security for the merchant.
Second, the bank verifies the address and correct CVV code, and sends the AVS and CVV response back to the gateway.
Step 3: The payment is either captured or authorized.
There is a difference between an “authorization” and a “capture”. Typically, the gateway will authorize & capture at the same time. However, if you have your gateway settings to DECLINE transactions that don’t match AVS or CVV, then the gateway will not capture the authorization if the AVS or CVV response that is received secondarily is NO MATCH. So, if the CVV or AVS fails after the authorization, the customer will see the “authorization” on their card. You will see a “Declined” transaction in your gateway reports.
Step 4: The authorized payment will be captured during the appropriate time, or the authorized hold will be lifted in 5-10 business days.
Authorizations reserve (ear-mark) the funds for the merchant for 7-10 business days. For example, when you check into a hotel on Friday night, the hotel authorizes funds on your card. The hotel doesn’t capture them though until you check out. That’s why hotels have signs at the front-desk that state “Do Not Use Your DEBIT Card for Check-In”. What your customer sees on their online statement is a “pending charge” (ie, authorization). This will automatically fall off of their account in due time (5-10 business days depending on the card issuing bank). The funds were never captured because the gateway filtered transactions that don’t meet your AVS or CVV rules.
Step 5: Discuss this AVS & CVC authorization and decline process with your customers.
Although your customer may request a refund, it’s not possible to process a “refund” or “chargeback” on an authorization like this. In fact, there isn’t even any transaction to reverse since the transaction was rejected for no AVS/CVV match. The funds simply don’t exist.
Some card issuing banks (Capital One, HSBC etc) may let you CANCEL a pending authorization, but you must call the card issuing bank with the customer to do this. The authorization protects merchants so the banks won't let customers cancel any authorization without confirming with the merchant. Even if you both contact the bank, we can't guarantee they will cancel the authorization. ALSO, there is no way to cancel an authorization on your end.
If you explain this process to the customer, hopefully they will understand. To actually bill the customer and process payment, you will need to obtain the correct Address or CVV and run a new sale. You can also have the customer go through the checkout process again with the correct information or a different card.
If you do employ AVS or CVV rules to help filter out fraudulent sales, we recommend that merchants add a statement along these lines during their checkout process:
"TO PREVENT FAILED TRANSACTIONS, BE SURE TO ENTER YOUR BILLING ADDRESS EXACTLY AS YOUR CREDIT CARD COMPANY HAS IT ON FILE"
A Quick Note On AVS Settings
Your customer may insist that they have given you the correct billing address. Unfortunately customers aren’t always right. If the response at the gateway states that the address does not match, the card issuing bank reported that response.
The payment gateway does not “create” these AVS responses. The gateway simply sends the address to the card issuing bank, then the card issuing bank responds if it matches or not. The gateway, and therefore you as a merchant, has no control over the AVS response from the card issuing bank. To change the verification error, the customer will need to call their bank and verify the address on file.
So Let's Review! Why did my customer get charged when their credit card declined?
It all has to do with the back end credit card process. When you swipe a credit card, the payment gateway has to verify four things…
- Is this card number correct?
- Is there enough funds in this account?* at this point an authorization or hold is placed on the credit card for the purchase amount.
- (If AVS and CVC rules are turned out) Does the address entered match the address on file for the credit card?
- Does the CVC code entered match the code on file?* If number three or four do not match, the card will decline. However the authorization placed after step two may take 5-10 business days to be removed. You and your customer don’t need to do anything. Monitor your funds and watch to make sure the pending charges drop off within a few days.
If you have any other questions or issues, please contact your Durango Merchant Services account manager! We’re happy to help! Authorizations can be tricky, especially if you have a high risk merchant account, but our expertise, network and experience can clear things up and make sure you have everything set up correctly.
Or, if you are stuck processing with some dinosaur of a bank that doesn’t have informative articles or dedicated account managers (what a shame!), then apply today for a free quote!
