About fraud prevention

Fraud prevention layers

Effective fraud prevention combines multiple verification methods.Reefpay integrates several checks that run automatically during transaction authorization.

Address Verification Service (AVS)

AVS compares the billing address provided in the transaction with the address on file at the card-issuing bank. The check happens automatically when you include address_line1 and zip in the payment method.

How to send AVS data

Include the address fields in the payment_method object.

{
  "type": "sale",
  "amount": 1999,
  "payment_method": {
    "type": "card",
    "pan": "4111111111111234",
    "expiry": {
      "month": "03",
      "year": "2028"
    },
    "cardholder_name": "John Doe",
    "cvv": "456",
    "address_line1": "123 Main St",
    "zip": "62704",
    "cvv": "456"
  },
  "metadata": {},
  "recurring": false,
  "purchase_description": "Dog food"
}

AVS result codes

The avs_result_code field in the transaction response indicates the match result.

Code	Description	Risk level
`y`	Street address and postal code both match	Low
`x`	Street address and ZIP+4 both match	Low
`a`	Street address matches, postal code does not	Medium
`z`	Postal code matches, street address does not	Medium
`w`	ZIP+4 matches, street address does not	Medium
`n`	Neither street address nor postal code matches	High
`b`	No address information provided or transaction declined	Review required
`r`	AVS unavailable or timed out — retry	Retry
`s`	AVS not supported by card issuer	Not applicable
`u`	Address information unavailable	Not applicable
`p`	AVS not applicable for this transaction	Not applicable

Interpreting AVS results

Paradise Pay returns the AVS result but does not automatically decline transactions based on AVS mismatch. It is your responsibility to decide how to handle each result.

Recommended approach:

y or x — proceed with the transaction.
a or z or w — partial match; proceed with caution or request the person to verify their address.
n — no match; consider declining or flagging for manual review.
r — retry the transaction.
s, u, p — AVS not available; rely on other fraud signals.

AVS is advisory

AVS results are informational. The processor may still approve a transaction with an AVS mismatch. Implement your own business logic to decide whether to fulfill orders based on AVS results.

CVV verification

The Card Verification Value (CVV / CVC / CID) is the 3- or 4-digit code printed on the physical card. Including the CVV in a transaction proves the person has possession of the card, reducing the risk of fraud from stolen card numbers.

How to send CVV

Include the cvv field in the payment_method object.

"payment_method": {
  "type": "card",
  "pan": "4111111111111234",
  "expiry": {
    "month": "03",
    "year": "2028"
  },
  "cardholder_name": "John Doe",
  "cvv": "456"
},

CVV result codes

The cvv_result field in the response indicates whether the CVV matched.

Visa

Code	Description
`M`	CVV match
`N`	CVV no match
`P`	Not processed
`S`	Merchant indicated CVV not present on card
`U`	Issuer not certified / no encryption keys

Mastercard

Code	Description
`0`	Authentication failed
`1`	Authentication attempted — liability shift applies
`2`	Authentication successful — full protection

American Express

Code	Description
`1`	AEVV failed — authentication, issuer key
`2`	AEVV passed — authentication, issuer key
`3`	AEVV passed — attempt, issuer key
`4`	AEVV failed — attempt, issuer key
`7`	AEVV failed — attempt, issuer not participating, network key
`8`	AEVV passed — attempt, issuer not participating, network key
`9`	AEVV failed — attempt, ACS not available, network key
`A`	AEVV passed — attempt, ACS not available, network key
`U`	AEVV unchecked

Interpreting CVV results

Match (M for Visa, 2 for Mastercard) — proceed normally.
No match (N for Visa, 0 for Mastercard) — high fraud risk; consider declining.
Not processed / unavailable — rely on other fraud signals.

CVV is never stored

PCI-DSS prohibits storing CVV after authorization.Reefpay discards the CVV immediately after the authorization check. For tokenized (stored) transactions, CVV is not required or available.

Address check on tokenized cards

When you create a payment token with address data,Reefpay verifies the address with the card issuer and returns address_check results.

{
  "payment_token": "PAYMENT_TOKEN-01KFDKXMQ637EKEAY410MSQSXB",
  "address_check": {
    "address_line1_match": "match",
    "address_zip_match": "match"
  },
  "brand": "visa",
  "last_four": "1234"
}

This lets you verify the person's address at tokenization time, before any transaction is processed.

Combining fraud signals

No single check is sufficient on its own. Use multiple signals together for effective fraud prevention.

Recommended fraud decision matrix

CVV result	AVS result	Suggested action
Match	Full match (`y`, `x`)	Fulfill order
Match	Partial match (`a`, `z`, `w`)	Fulfill low-value; review high-value
Match	No match (`n`)	Flag for review or decline
No match	Any	Decline
Unavailable	Full match	Fulfill with monitoring
Unavailable	No match	Decline or hold for review

Additional fraud prevention measures

Beyond AVS and CVV, consider implementing these application-level controls.

Velocity checks

Monitor transaction frequency to detect automated fraud attempts.

Check	Example threshold	Action
Transactions per card per hour	> 5	Block and alert
Declined transactions per IP	> 3 in 10 minutes	Temporary IP block
Total amount per card per day	> 5,000.00 USD	Require additional verification

Order-level signals

Shipping vs. billing address mismatch — higher fraud risk for card-not-present transactions.
Email domain — free email providers correlate with higher fraud rates.
Device fingerprinting — repeated attempts from the same device with different cards.
Geolocation — IP location differs significantly from billing address.

3D Secure (3DS)

3D Secure adds an issuer-controlled authentication step (for example, Visa Secure, Mastercard Identity Check). When the cardholder successfully authenticates, liability for fraudulent chargebacks shifts from the merchant to the issuing bank.