Developer's Guide

Performing Direct Payment Credit Card Transactions
Card Security Code Validation
4
40 Website Payments Pro Developer’s Guide
NOTE: AVS checks only for a street number match, not a street name match, so
123 Main Street returns the same response as 123 Elm Street.
The International Address Verification Service response indicates whether the AVS response is
international (Y), USA (N), or cannot be determined (X). SDK version 3.06 or later is
required.
Example AVS Request Parameter String
This example request includes the AVS request parameters STREET and ZIP.
EXAMPLE 4.17 Request string with AVS request parameters
"TRXTYPE=A&TENDER=C&PWD=SuperUserPassword&PARTNER=PayPalUK&VENDOR=SuperMerc
hant&USER=SuperMerchant&ACCT=5555555555554444&EXPDATE=0308&AMT=123.00
&STRE
ET=5199 Maple&ZIP=98765
"
Example AVS Response
In this example, the address value matches the value in the bank’s records, but the postcode
does not. The IAVS response is X.
EXAMPLE 4.18 AVS response parameters
RESULT=0&PNREF=EFHP0D426A56&RESPMSG=APPROVED&AVSADDR=Y &AVSZIP=N&IAVS=X&CORR
ELATIONID=2dc60e253496a
For details on Address Verification responses, see “Address Verification Responses from
PayPal” on page 71.
Card Security Code Validation
The card security code is a three or four-digit number (not part of the credit card number) that
is printed on the credit card. Because the card security code appears only on the card and not
on receipts or statements, the card security code provides some assurance that the physical
card is in the possession of the buyer.
NOTE: This fraud prevention tool has various names, depending on the payment network. Visa
calls it CVV2 while MasterCard calls it CVC2. To ensure that your customers see a
consistent name, PayPal recommends use of the term card security code on all end-user
materials.
You must provide a CVV2 value as a transaction parameter for those credit cards that use card
security code validation. The value is required for Visa, MasterCard, Switch, and Solo cards.
IMPORTANT:To comply with credit card association regulations, you must not store the
CVV2 value.