That's entirely up to the merchant, not the processor (or the gateway, either of the banks, or any of the other middlemen). From the link you gave "You will ne

That's entirely up to the merchant, not the processor (or the gateway, either of the banks, or any of the other middlemen). From the link you gave "You will need to log into your payment gateway website and adjust these settings as you learn your customer profile and behavior." Most merchants want to sell things, and don't want to constantly field complaints from customers (or bad word of mouth from lost customers), so they set them to rather loose settings. The fraud checks go through many middlemen each with their own systems, with their own bugs and limitations. Any programmer could guess a few. If the address is "apt 2, 300 main street" entered as "300 main st, apt 2" (or vice-versa), it can fail. If the zip code is 9-digits entered as 5 (or vice-versa), it could fail. Of course, the customer doesn't know exactly what pattern the system is looking for. If the punctuation is different, it might fail. If there are unexpected characters or encodings that any system or network in the chain can't handle properly, it might fail. If any of the systems is in a different country from any of the others, it might fail. In fact, AVS doesn't work in most countries (or at least didn't, last time I checked.) The internet brings international customers, but the payment systems aren't really internationalized. So the question becomes, do we tighten this down to try to reduce fraud at the cost of losing 2/3rds of our regular repeat customers and limiting ourselves to only U.S. customers? Unless the cost of fraudulent transactions regularly exceeds 2/3rds of your revenue and you're intentionally a U.S.-only business, probably not. Companies would rather ignore AVS and expiration date failures than go out of business.