2

When I pay for some bill online in the USA (US card, US merchant), sometimes I am being asked for my entire address, and sometimes I am being asked for only my ZIP code. Why? Different levels of security? The entire address is used for what purpose (e.g., spam)? etc.

enter image description here

Improve this question

3 Answers 3

Reset to default
10

Some merchants compare shipping and billing addresses as another security measure. Some even won't allow shipping to an address that doesn't match billing (especially for more high-value products).

It can also be a requirement of the billing processor to reduce the risk of chargebacks depending on the merchants' risk profiles.

Improve this answer
7

There's a credit card verification protocol called "AVS" for "Address Verification Service". It's a way to verify an authorized user is making the purchase by verifying the billing address for the purchase with the address on file with the credit card.

It's more than just "pass/fail", because both the street address and the zip code can be verified. The AVS response will confirm if the street address and zip code match, whether it was a 5-digit zip code or 9-digit match, or if just one of them matches, or if none of them pass.

The merchant can then decide whether to allow/authorize the sale based on how well the AVS response matches their own security practices. For example, in-state sales may be allowed if just the zip code passes, US domestic sales may be rejected if either the street address or zip fails, and foreign sales or sales with gift cards may be disallowed.

And some merchants are comfortable just asking for a zip code match. With the added protection of CVV codes (those 3 or 4 digits on the back of the card), an AVS check of just the zip code is often adequate for the purposes of fraud protection.

Improve this answer
4
  • 2
    Notably, it's just the numbers in the street address that get compared. The text is ignored.
    – Bobson
    Commented Jun 4 at 7:54
  • @Bobson: That's surprising, and a little concerning. Do they handle addresses correctly if there's more than one number (e.g. apt/suite/whatnot)? In theory, that information should be on line 2 of the address, but in practice, the form shown in OP's screenshot does not have a line 2.
    – Kevin
    Commented Jun 4 at 18:25
  • 1
    @Kevin just the street number is verified, e.g. if you enter "8531 Main St Ste 123", just the "8531" is checked for the address portion of the AVS match. AVS has always been this way because it's easier for software to parse out the numbers and not have to deal with spelling variations while still providing address verification.
    – Rocky
    Commented Jun 4 at 18:39
  • 1
    @Kevin You have to think of the threat model. AVS protects against non-sophisticated criminals using cards found on street or waiter copying down the info. The 5-digit ZIP could be guessed based on the location the card was obtained. Getting the street number adds enough entropy to cut the chances down around 1/1000, which is good enough. With address info being available online and large-scale data breaches being an issue, it's not worth improving.
    – user71659
    Commented Jun 4 at 22:40
3

Zip code is sometimes used as additional verification of credit card, since that is information not on the card itself.

Verifying the full billing address is better, but more hassle for the customer if shipping somewhere else and possibly more expensive as a service from the credit card company.

It's all trade-offs and business decisions.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .