Drive address and security code results
Make the sandbox return a match, a mismatch, and an issuer that can't check, for the address and for the security code.
Your answers so far
Choose one
What to build
Run the AVS blueprint and the CVV blueprint. Each sends the three cases side by side, so you can compare the codes your integration reads and confirm it doesn't assume a check passed because the payment was approved.
What this means for PCI
This is guidance rather than a compliance determination. Which questionnaire you are eligible for depends on your full environment, so confirm it with your QSA or your acquirer before you rely on it.
Worth knowing
- A merchant's own verification rules can refuse an approved payment. That arrives as a policy rejection, which is never retried unchanged.