AVS and CVV checks and chargebacks on Shopify: what they do and do not protect for UK sellers

A customer in Nottingham pays £420 for a coffee machine. Your admin shows the card passed its address check and the security code was correct. Everything looks clean, so you ship it the same day. Seven weeks later the cardholder tells her bank she never made the purchase, and £420 plus a £10 fee leave your Shopify balance. The checks passed, and you lost anyway. AVS and CVV checks are useful, but they are not the protection many sellers think they are.

AVS and CVV checks are the address and security code tests a card payment goes through at the moment of purchase. AVS asks whether the billing address given matches what the card issuer holds. CVV asks whether the short code on the card was entered correctly. A pass is a good sign and a fail is a warning. Neither decides a later dispute, because the issuing bank makes that decision, and Shopify says plainly that it does not cover charge reversals from banks. This guide explains what each check does, what the results mean, how to use them before shipping, and how to mention them in a response without overclaiming.

This guide is for you if:

• You sell on Shopify Payments in the UK and see address and security code results on your orders.
• You have shipped an order that passed every check and still ended in a fraud dispute.
• You want a rule for which failed checks should stop an order and which should only prompt a question.

Last updated: 22 October 2026. Written by the ChargeFix team. Reviewed against sources on 22 October 2026. General information, not legal or financial advice.

Disclosure. ChargeFix helps merchants respond to Shopify Payments disputes, so I benefit when disputes need answering. Shopify's own fraud analysis page lists AVS and CVV checks as indicators but does not describe the result values, so where I explain how they are usually read, I say it is general knowledge and not from Shopify. I found no published UK data on how often passed checks still end in disputes, so the examples are made up and labelled.

The 30-second answer (TL;DR)

• AVS and CVV checks run address verification and a card security code test at payment. Shopify lists both as fraud indicators.
• Shopify's page does not say that passing them protects you from a chargeback, and warns that individual indicators do not show an order's overall risk.
• A pass is reassuring and a fail is a reason to look closer, not an automatic cancel. Genuine customers fail checks for ordinary reasons.
• Stolen card details often come with the correct address and code, so a pass does not rule out fraud.
• Use AVS and CVV checks beside the overall risk level, order history and a confirmation email for larger orders.

Do this today (10 minutes):

1. Open your last five fraud disputes and look at the AVS and CVV results on each order.
2. Count how many passed both checks. That number shows how little a pass protects you.
3. Write one sentence on what you will do differently with a fail on an order above your value threshold.

Where AVS and CVV checks sit in the order

Stage	What can go wrong	The record that protects you
Checkout	Card details entered by someone else	AVS and CVV results stored with the order
Payment	A thief has the full card details	Fraud risk level, order pattern
Dispatch	A failed check is ignored	A dated note of what you checked
Delivery	Parcel goes to a drop address	Address match, delivery proof
After delivery	Cardholder says "not me"	History, emails, confirmation reply
Dispute	Reviewer sees passed checks	A response that does not rest on the pass alone

What do AVS and CVV checks actually test?

AVS stands for address verification service. When a customer enters a billing address, the payment system can ask the card issuer whether that address matches the one the issuer holds for the card. In general terms, the check compares the numbers in the address, such as the house number and the postcode digits. CVV is the card verification value, the short code printed on the card. It tests whether the person entering the payment had that code to hand.

This is general knowledge about how these checks usually work and is not from Shopify's page, which lists both among its indicators without describing the details.

Check	What it compares	What a pass shows	What a pass does not show
AVS	Billing address given against the issuer's record	The person knew the address on file	That they are the cardholder
CVV	The code entered against the card's code	The person had the code	That they hold the physical card

A thief who has bought a full card record from a data breach usually has the address and the code. So AVS and CVV checks are good at catching careless misuse and weak at catching organised fraud. They filter out the easy cases and leave the difficult ones.

What does Shopify's fraud analysis say about these checks?

Shopify's fraud analysis page lists, among its fraud indicators, whether the card passes address verification checks and whether the customer provided the correct card verification value. It does not describe the possible result values, does not say whether they are shown for Shopify Payments in a different way from other gateways, and does not name countries.

For eligible online card orders, Shopify gives a recommendation of low, medium or high risk of a chargeback due to fraud. Medium and high risk orders show a warning on the Orders page. The guidance reads "You can fulfill this order", "Confirm with the customer before fulfilling" or "Consider canceling this order", and it follows the overall recommendation, not any single indicator. For high risk orders you can try to verify, cancel or refund.

The page makes two statements worth quoting in spirit. Individual indicators "don't represent the order's overall risk level", so the recommendation should be reviewed instead. And Shopify "doesn't cover charge reversals from banks", because the bank that issued the card decides. Nothing on the page says that passing AVS and CVV checks protects you from a chargeback.

What Shopify says	What it means for you
AVS and CVV are indicators	They feed the picture; they are not the picture
Indicators do not show overall risk	A pass on both can sit inside a high risk order
Recommendation follows the overall level	Read the recommendation, not one line
Shopify does not cover bank reversals	A passed check is not insurance
Fraud indicators need Basic or higher; recommendations need Grow or higher, or Shopify Payments	Check which you can see

Why does passing AVS and CVV checks not stop a chargeback?

There are three reasons, and they explain why sellers are surprised. First, the checks run at payment, but a chargeback is a later decision by a different party for a different reason. The issuer looks at whether the cardholder says they made the purchase, not at what the checks said on the day.

Second, the checks measure knowledge, not identity. Anyone who knows the address and the code passes. A thief with full details, a family member, or a friend using the card with permission all pass.

Third, many disputes are not fraud at all. A customer who received the goods and wants their money back, a customer who forgot an order, or a customer whose parcel went missing will dispute, whatever the checks said. A pass on AVS and CVV checks says nothing about those claims.

Dispute reason	Do passed checks help?	What decides it
Fraudulent	A little	Whether the cardholder made the purchase
Unrecognised	A little	Whether the cardholder knew the charge
Product not received	No	Delivery proof
Product unacceptable	No	Listing, photos, returns replies
Credit not processed	No	Refund records and policy

If you want a broader view of how liability moves at payment, our guide on 3D Secure and liability shift covers a different layer of protection. It is separate from AVS and CVV checks, which are signals, not guarantees.

What do AVS and CVV results mean, and how should you read them?

Shopify's page does not list result values, so the following is the general way these checks are usually read. Your admin may show them differently, so treat this as a map, not a rule book.

AVS	CVV	Usual reading	Suggested action
Pass	Pass	Normal for honest customers and for organised fraud	Judge by overall risk and value
Pass	Fail	The person knows the address but not the code	Look closer, may be a typo
Fail	Pass	The code is right but the address differs from the issuer's record	Common for movers and new addresses
Fail	Fail	Neither matches	Hold and verify
Unavailable	Unavailable	The issuer did not return a result	Rely on other signals

The most useful row is the last. Not every card or issuer returns an address result, so "unavailable" is not the same as "fail". Treat it as missing information.

For honest customers, a failed AVS is common. People move house and forget to update the bank. They enter a flat number differently. They use a work address as billing. They pay with a card issued abroad, where address checks may not apply. A rule that cancels every AVS fail will cancel a lot of good orders.

When do genuine customers fail AVS and CVV checks?

It helps to know the innocent causes, so you do not treat each fail as fraud.

Cause	Check affected	How to tell
Customer recently moved, bank not updated	AVS	Order history shows an older address
Flat or unit entered differently	AVS	Compare the two address lines
Card issued outside the UK	AVS	Foreign card, no UK postcode
Business or corporate card	AVS	Company name in the address
Typo in the code	CVV	A second attempt passes
Digital wallet payment	Either	Wallet payments use device tokens, so compare a wallet order with a card order in your admin
Issuer does not support the check	AVS	Result shows unavailable

I did not research how each UK issuer or wallet returns these results, so I cannot say how often a given cause occurs. Look at your own orders. If you find that most of your AVS fails are repeat customers who later receive and keep their orders, your rule should be gentle.

How do you use AVS and CVV checks before you ship?

Combine the checks with the overall risk level and the value of the order. A rule that uses all three is more accurate than any one on its own. Choose a value threshold. For a store with a £40 average order, £150 might be the line. For a store selling £400 items, perhaps £500.

Situation	Action
Both checks pass, low risk, any value	Ship, keep the screenshot
Both pass, medium or high risk, above threshold	Confirm with the customer first
One fails, low value, returning customer	Ship, note it
One fails, above threshold	Email to confirm before shipping
Both fail, any value above a small amount	Hold, verify or cancel
Many failed attempts on one session	Cancel, suspect card testing

A confirmation email to the address on the order costs a minute and gives you strong evidence:

Subject: Please confirm your order #4012

Hi,

Thank you for your order. Our payment checks could not match the
billing address you entered with your bank's records, which sometimes
happens after a house move. To protect you and us, we confirm orders
of this size before we dispatch.

Please reply "confirmed" with the billing address on your card and
we will send your order today. If you did not place this order,
reply "not mine" and we will cancel and refund it.

Thank you,
The Example Store team

A "confirmed" reply from the email on the order is better evidence than the check results. A "not mine" reply stops a dispute before it starts.

What does manual review look like when AVS and CVV checks fail?

Manual review means a person looks at the order before it ships, instead of letting it through on autopilot. It does not need to be elaborate. For a small store, it is a five minute routine applied only to orders above your threshold or with a failed check. The aim is to turn a worrying signal into a yes or a no, with a record either way.

Start with the facts on the order page: the risk level, the AVS and CVV results, the billing and shipping addresses, whether the customer is new, and the value. Then look at the pattern. A returning customer who failed an address check after moving house is a different case from a first-time buyer who failed the card security code twice and then passed with a different card. Write one line in the order notes saying what you saw and what you decided, with the date.

Step in manual review	What you do	What you record
1. Read the order	Risk level, AVS and CVV results, addresses	A screenshot with the date
2. Look at the customer	New or returning, earlier orders, earlier disputes	A line in the notes
3. Look for a pattern	Several orders from one connection, many cards	A line in the notes
4. Decide	Ship, ask, hold or cancel	The decision and the time
5. If you ask	Email the address on the order	The thread
6. If they reply	Ship, or cancel and refund	The reply and the action

The card security code deserves one specific habit. If the card security code fails and the customer tries again at once with a correct code, that is usually a typo. If the card security code fails on several different cards in a row, that is guessing, and the order should not ship. You cannot see the code itself, only the result, and you must never ask a customer to send it to you by email or chat, because card rules do not allow you to store it.

Manual review costs time, and time is the reason to keep it narrow. A store that reviews every order will stop doing it. A store that reviews only orders with a failed check, a medium or high risk level, or a high value will keep doing it. Pick the narrow version, write it down, and let whoever packs orders follow it. In all of this, AVS and CVV checks are the trigger, never the verdict.

How do you spot card testing from failed AVS and CVV checks?

Card testing is when a thief tries many stolen card numbers on small orders to find which ones work. The pattern in your admin is distinctive: many orders in a short time, often small amounts, often from one connection, with many failed security codes or declined payments, and a few that pass.

Sign	Why it points to card testing
Dozens of failed payments in an hour	Trying many numbers
Small amounts, often a cheap product	Cheap to test
Different cards from one connection	One person, many cards
Failed security codes in sequence	Guessing the code
Many new email addresses with similar patterns	Throwaway accounts

If you see this, stop shipping unreviewed orders, review the ones that passed, and contact Shopify or your fraud tool provider. Card testing creates both fees and chargebacks, and a few passed orders in the middle can become disputes weeks later. I did not research Shopify's specific protections against card testing, so check its help pages and your plan.

How do AVS and CVV checks work with 3D Secure, wallets and keyed orders?

Different payment routes carry different checks. A card entered by hand goes through AVS and CVV. A digital wallet payment uses a device token, and a guide from the fraud vendor Ravelin says liability typically shifts to the issuer for Apple Pay and for Google Pay device-token payments. A card payment that goes through 3D Secure adds a step in which the cardholder proves identity to their bank. In general terms, that step can move liability for some fraud disputes to the issuer, but the rules depend on the card scheme and the case. Our separate guide on 3D Secure covers them.

For orders you key in yourself by phone or email, you may collect the card details by hand, and those orders sit outside the usual checkout. Treat them with extra care, and never store the security code, which card rules do not allow. I did not research the specific requirements, so take advice from your payment provider.

Route	Checks involved	Note
Online card entry	AVS and CVV	Standard
Digital wallet	Device token, authenticated on the phone	Compare with a card order
Card with 3D Secure	Extra identity step	See our guide
Keyed order by phone	Depends on your set-up	Extra care, never store the code

How do you mention AVS and CVV checks in a response?

Mention them in one factual sentence, in the middle of your response, never at the top. Lead with delivery proof and the strongest link between the card and the buyer. Passed checks support the story but cannot carry it.

Payment checks

At checkout on 11 October 2026 the card passed the address check and
the security code check recorded by Shopify. The fraud analysis
recommendation for the order was low risk. [attach screenshot of the
order page showing the results and the date]

If a check failed and you shipped, say what you did:

Payment checks

The address check did not match the issuer's record. On 11 October
2026 we emailed the address on the order to confirm. The cardholder
replied "confirmed" on the same day and gave the billing address
shown on the card. [attach the email thread]

Do not write that the passed checks "prove" the cardholder placed the order. They do not, and a reviewer knows it. Overclaiming costs you credibility on the rest of the response.

Shopify's help page says the response deadline is usually 7 to 21 days after filing, that progress autosaves and that submitting early locks your edits. If you add nothing, Shopify submits the evidence it collected itself. So take your screenshot of the order page at the time you ship, not when the dispute arrives, because the page may look different later.

Should you fight when AVS and CVV checks passed?

Often, but not because of the checks. The question is whether the rest of your evidence is strong.

Question	If yes	If no
Was the parcel delivered to an address the cardholder used before?	Strong, fight	Weaker
Did the cardholder confirm the order by email?	Very strong	Neutral
Does the customer have undisputed history?	Strong	Think harder
Is there a signature or photo at delivery?	Supports	Rely on checks and history
Is the amount above the £10 fee and your time?	Worth answering	May not be

The UK dispute fee on Shopify Payments is £10 and is returned if you win. The disputed amount leaves your balance at once. No tool can promise a win, because the issuing bank decides.

What is a dated plan for putting AVS and CVV checks to work?

This plan starts on Monday 2 November 2026 and finishes before Valentine's Day 2027.

Date	Task	Output
Mon 2 Nov	Find where AVS and CVV results appear in your admin	A screenshot and a note
Tue 3 Nov to Fri 6 Nov	Review your last 20 fraud or unrecognised disputes against their check results	A table of passes and fails
Mon 9 Nov to Fri 13 Nov	Set your value threshold and write the confirmation email	A saved template
Mon 16 Nov to Fri 20 Nov	Write your rule table for fails and unavailable results	A one page routine
Mon 23 Nov to Thu 26 Nov	Test the routine on live orders	A log of held and confirmed orders
Fri 27 Nov	Black Friday: apply the routine above your threshold	Fewer unreviewed risky orders
Mon 4 Jan to Fri 29 Jan 2027	Answer post-Christmas disputes with a screenshot of the checks	Responses filed before deadlines
Fri 5 Feb 2027	Compare dispute counts with your baseline	An updated threshold

What does this look like for three UK merchants?

These are made-up examples.

A coffee equipment shop in Nottingham. Average order £280. The owner finds that four of the last six fraud disputes passed both checks. A rule is added: orders above £350 get a confirmation email whatever the checks say. Two later orders are cancelled after "not mine" replies, and each would have been a £360 dispute.

A fashion label in Brighton. Average order £75. Many customers are students who move often, so AVS fails are common. The owner decides a single AVS fail on an order under £150 from a returning customer is shipped with a note. A fail on a first order above £150 gets a short email.

A gadget seller in Edinburgh. Average order £55. One evening the admin shows forty small orders in an hour with many security code failures. The owner pauses shipping, reviews the six orders that passed, cancels four, and finds that two had been placed from the same connection with different cards.

What is different for UK merchants?

The Shopify Payments dispute fee for UK merchants is £10, returned only if you win. Shopify Protect, which covers some fraud chargebacks, is for US stores only on Shopify's own pages, so UK sellers carry the fraud risk of a passed check themselves. UK postcodes are precise, so address checks can be useful when they work, but moves and flat numbering still cause honest fails.

Strong customer authentication rules and 3D Secure are part of the UK and European card market. Read our 3D Secure guide for how they affect liability.

A community answer on Shopify's forum, written by another merchant and not Shopify staff, reports that the raw AVS code and issuing bank are available through the API but not on the order details page, and that the setting "Decline charges that fail AVS postal code verification" sits under Payments, Manage, in the Fraud prevention section. The only code shown in that thread was N, with the gateway message "Street address and postal code do not match." Check both in your own admin, and note that AVS results vary by issuing bank.

What are the common mistakes with AVS and CVV checks?

1. Treating a pass on AVS and CVV checks as insurance. Shopify does not cover bank reversals, and the checks do not decide a dispute.
2. Cancelling every AVS fail. Movers and flat dwellers fail honestly.
3. Reading one indicator instead of the overall risk. Shopify says individual indicators do not show overall risk.
4. Ignoring "unavailable". It means no result, not a fail.
5. Shipping a high value order on a pass alone. Stolen cards often come with the right address and code.
6. Not saving a screenshot at the time. The page may look different when the dispute arrives.
7. Writing that the checks "prove" the buyer. They test knowledge, not identity.
8. Missing card testing. A run of failed codes is a warning to stop and review.
9. Storing a security code from a keyed order. Card rules do not allow it.
10. Missing the deadline. After it passes, only Shopify's automatic evidence goes in.

Frequently asked questions

What are AVS and CVV checks?

AVS and CVV checks are tests run at payment. Address verification compares the billing address entered with the issuer's record. The card security code check tests the short code printed on the card. Shopify lists both as fraud indicators. A pass is a good sign and a fail is a warning, but neither decides a later chargeback.

Do AVS and CVV checks stop chargebacks?

No. They help you spot risky orders before shipping, but a chargeback is a later decision by the issuing bank. Shopify's fraud analysis page does not say that passing checks protects you, and it states that Shopify does not cover charge reversals from banks.

Should I cancel an order when AVS fails?

Not automatically. Honest customers fail address checks after moving, with flat numbers, with business cards or with foreign cards. For small orders from returning customers, ship with a note. For larger orders, email the address on the order and ask for a "confirmed" reply before shipping.

What does "unavailable" mean for AVS?

It generally means the issuer did not return an address result, which is different from a fail. Shopify's page does not describe result values, so treat unavailable as missing information and rely on other signals such as overall risk, order history and a confirmation email.

Can I use AVS and CVV results in a chargeback response?

Yes, in one factual sentence, with a screenshot of the order page showing the results and the date. Put it in the middle of the response, behind delivery proof and history. Never write that passed checks prove the cardholder ordered, because they test knowledge, not identity.

Does Shopify show AVS and CVV results for Shopify Payments?

Shopify lists them as fraud indicators and says orders without newer indicators can still display address and payment checks. The page does not say how results look on Shopify Payments in the UK, so open a recent order and check your fraud analysis section.

How can I tell card testing from ordinary failed AVS and CVV checks?

Card testing shows as many orders in a short time, often small amounts, different cards from one connection, and runs of failed security codes. A single failed code is usually a typo. A dozen in an hour is a pattern, and the right move is to pause shipping and review.

How much does a fraud dispute cost in the UK?

On Shopify Payments the disputed amount and a £10 fee leave your balance when the chargeback opens, and the fee returns only if you win. If the goods have shipped you also lose them. A £420 order therefore costs £430 at once, plus the goods if you lose.

Is 3D Secure the same as AVS and CVV checks?

No. AVS and CVV checks are signals about the details entered. 3D Secure adds a step where the cardholder proves identity to their bank and can change who bears liability for some fraud disputes. The rules depend on the card scheme, so read our separate guide and your provider's terms.

Should I fight a dispute where AVS and CVV passed?

Fight when you hold delivery to a known address, a clean history or a confirmation email, not because the checks passed. Consider accepting when the order is new, high value and thinly documented. A weak response uses time and cannot be changed once Shopify has filed it.

Start free trial with ChargeFix

For AVS and CVV checks to help in a response, the results have to be recorded at the time and sit beside the right delivery and order records. ChargeFix reads the real order, payment, tracking and delivery data for each Shopify Payments dispute, scores the evidence and drafts the response from your own records, never inventing facts. You review and file it, or let Auto mode handle them. Start free trial

Sources

• Fraud analysis, Shopify Help Center
• Responding to chargebacks and inquiries, Shopify Help Center
• Chargebacks and inquiries, Shopify Help Center
• Shopify Protect, Shopify
• ChargeFix support page
• Why doesn't Shopify Payments decline orders with a low AVS score, Shopify Community