No card issuer is going to verify a transaction of any significant value without AVS. AVS dropped fraud rates on card-not-present transactions dramatically, and it'd skyrocket without it.
>No card issuer is going to verify a transaction of any significant value without AVS
irl, Card acquirers do verify transactions without AVS, but they charge higher provided the merchant can demonstrate pre-transaction fraud mitigation
>AVS dropped fraud rates on card-not-present transactions dramatically, and it'd skyrocket without it.
AVS was less than moderately effective 6-7 years back, but it's less effective now, almost not at all. Most "researchers" have the card dumps with the addresses already so AVS does nothing to decrease the attack surface. Pre-transaction approval risk mitigation and post transaction fraud review is the only thing that works.
AVS doesn't deny anything. Its a status code returned on the auth. Its up to the merchant to reverse the auth if AVS data shows it doesn't match(Exact Address,Zip Code, CVV) or send the auth off for settlement. Merchant has almost no recourse if transaction is marked as fraud and the AVS doesn't match.
It may be up to the merchant, technically, but in reality systems such as Authorize.Net allow you to configure it at the gateway to reject transactions based on various AVS criteria. Many of my clients also only allow shipping to the AVS verified billing address as a way to weed out much of the fraud. For many products, only allowing shipping to the billing address is a reasonable restriction.
