MercuryPay - Manual Entry and Card-Not-Present Fraud Protection

Document created by Worldpay Developer Community Support Team on Oct 17, 2016Last modified by andrew.harris on Oct 15, 2019
Version 5Show Document
  • View in full screen mode

Implementing AVS and CVV on MercuryPay

For POS applications that support manually entered or card-not-present transactions, implementing Address Verification (AVS) and Card Security Code (CVV/CVV2/CID) data in the transaction request and interpreting the results will assist merchants in preventing credit card fraud and protecting them from the possibility of unnecessary chargebacks.  Where implementing AVS and CVV into a transaction request is an easy addition to your code, interpreting and messaging the corresponding results will have merchant and transaction dependencies.

 

Integration Guidelines

  1. AVS and CVV result codes are single digit, card-brand specific, alpha values used to indicate a match, mismatch, partial match or that the system supplying the information is unavailable.
  2. When AVS and CVV data is supplied is a standard Sale or PreAuth, the corresponding result codes are passed back from the card issuer in the transaction response along with the authorization.  The card issuer, in most cases, will not decline the transaction based on an AVS or CVV mismatch.
  3. When AVS and CVV are supplied using ZeroAuth, a non-authorizing request, result codes are passed back in the response without charging the cardholder.
  4. AVS and CVV are effective tools used to help merchants make a decision on whether to proceed with a sale or delivery of goods and services. 


Implement, Interpret, Message

Merchants can only prevent fraud and protect themselves from chargebacks if their POS application provides the features to do so. The value of implementing AVS/CVV fraud protection lies in how the POS interprets and messages the results to the merchant.  The POS builds logic to message in real time if the response indicates a mismatched or questionable AVS/CVV result and then prompts for applicable corrective measures—be that a void/reversal, retry or to seek another form of payment altogether.  Appropriate corrective measures can vary and are dependent on the merchant’s business environment, amount of the transaction, how often the card is being attempted and, if applicable, shipping/billing address mismatch.

 

In cases of non-matching, questionable or partial results  are indicated within the flow of an approved transaction authorization sent by the issuing bank, the POS application should:

  • Prompt the mismatch to the end user
  • Provide an option for the merchant to reject the transaction immediately by running a Reversal VoidSale and to allow for reentry of the mismatched data
  • Provide an option for the merchant to accept the transaction authorization as-is based on merchant’s business need. 

 

   To avoid phishing threats for CVV data we recommend allowing no more than three attempts that return a non-matching response.

 

AVS and CVV Testing Guide

MercuryPay's Cert.Net

 

  AVS and CVV may be tested independently or together.  When testing AVS and CVV together, note that certain tests require a “filler value” for our test environment to generate the expected result code. These are identified below with a [f] next to the filler value.

AVS Tests

 

Input Values                                                                                                                Result

American Express

Address

Zip (5 or 9 digit as listed)

Code

Meaning

150 Mercury Village

81301 or 813011234

Y

Address and zip match

150 Mercury Village

not 81301 or not 813011234

A

Address only matches

not 150 Mercury Village

81301 or 813011234

Z

Zip only matches

not 150 Mercury Village

not 81301 or not 813011234

N

Neither address nor zip match

123 AVE U

(case sensitive!)

12345

[f] If processing with CVV, use CVV 0000

U

Information unavailable

123 AVE R

(case sensitive!)

12345

[f] If processing with CVV, use CVV 0000

R

Retry, system unavailable

 

Input Values                                                                                                                Result

 

 

Discover Card

150 Mercury Village

81301 or 813011234

Y

Address and zip match

150 Mercury Village

not 81301 or not 813011234

A

Address matches, zip code does not

not 150 Mercury Village

81301 or 813011234

Z

Zip code matches, address does not

not 150 Mercury Village

not 81301 or not 813011234

N

Neither Address nor zip match

12343

12345

[f] If processing with CVV, use CVV 000

U

System unavailable, retry

 

Input Values                                                                                                                Result

 

 

MasterCard

Address

Zip (5 or 9 digit as listed)

Code

Meaning

150 Mercury Village

81301 or 813011234

Y

Address and zip match

150 Mercury Village

not 81301 or not 813011234

A

Address matches, zip code does not

not 150 Mercury Village

81301 or 813011234

Z

Zip code matches, address does not

not 150 Mercury Village

not 81301 or not 813011234

N

Neither address nor zip code match

123 AVE S

(case sensitive!)

12345

[f] If processing with CVV, use CVV 000

E

AVS not supported; system unavailable 

123 AVE R

(case sensitive!)

12345

[f] If processing with CVV, use CVV 000

R

Retry

123 AVE U

(case sensitive!)

12345

[f] If processing with CVV, use CVV 000

U

Information unavailable; no data from issuer

 

 

Input Values                                                                                                                Result

Visa

150 Mercury Village

81301 or 813011234

Y

Address and zip match

150 Mercury Village

not 81301 or not 813011234

A

Address matches, postal code does not

not 150 Mercury Village

81301 or 813011234

Z

Postal code matches, address does not

not 150 Mercury Village

not 81301 or not 813011234

N

Neither match

123 AVE R

(case sensitive!)

12345

[f] If processing with CVV, use CVV 000

R

Retry, system unavailable

123 AVE U

(case sensitive!)

12345

[f] If processing with CVV, use CVV 000

U

System unavailable

123 AVE B

(case sensitive!)

12345

[f] If processing with CVV, use CVV 000 

A

Address matches, postal code not verifiable

123 AVE P

(case sensitive!)

12345

[f] If processing with CVV, use CVV 000

Z

Postal code matches, address not verifiable

123 AVE M

(case sensitive!)

12345

[f] If processing with CVV, use CVV 000

Y

International address and postal code match

 

CVV Tests

 

   AVS and CVV may be tested independently or together.  When testing AVS and CVV together, note that certain tests require a “filler value” for our test environment to generate the expected result code. These are identified below with a [f] next to the filler value.

 

 

 

  Results

Value

Notes and AVS “filler” value

Code

Meaning

American

Express

1234

 

M

Match

4321

Or any 4 digit value not 1234

N

No Match

4444

[f] If processing with AVS use Street: NO1, ZIP: 12345

U

CID was not checked

 

 

 

 

 

Discover Card

123

 

M

Match

321

Or any 3 digit value not 123

N

No Match

444

[f] If processing with AVS use Street: NO1, ZIP: 12345

U

Issuer not certified

 

 

 

 

 

MasterCard             

123

 

M

Match

321

Or any 3 digit value not 123

N

Invalid CVC 2 (non-match)

222

[f] If processing with AVS use Street: NO1, ZIP: 12345

P

Unable to Process

444

[f] If processing with AVS use Street: NO1, ZIP: 12345

U

Issuer not certified

 

 

 

 

 

Visa                          

123

 

M

Match

321

Or any 3 digit value not 123**

N

No Match

222

[f] If processing with AVS use Street: NO1, ZIP: 12345

P

Unable to Process

444

[f] If processing with AVS use Street: NO1, ZIP: 12345

U

Issuer not certified

 

**Visa declines failed CVV with DECLINE-CV2 FAIL

3 people found this helpful

Attachments

    Outcomes