> i've always found it to be profoundly messed up that address validation (AVS) and security code validation (CVV/CSC) happen after the funds are authorized and

> i've always found it to be profoundly messed up that address validation (AVS) and security code validation (CVV/CSC) happen after the funds are authorized and held by the issuing bank. That's because the alternative is the acquiring/issuing bank doesn't immediately reflect the authorisation in the shadow balance and only deducts it once either a confirmation has been received or a certain amount of time has elapsed, and of course that leads to a very chatty protocol and race conditions. Not to mention that the systems on the backend side at the acquiring/issuing bank would have to put the parts together. My experience with writing integrations with acquiring banks was that you needed to issue a reversal to have the held funds actually removed from the shadow balance. But it didn't always work, something about the reversals having to be the next request immediately after the corresponding auth. Obviously this was a system not built to scale and the whole AVS/CVV was a bolt on. AVS is most interesting because (at least using APACS 70, not so much ISO 8583 depending on the acquirer/issuer) it only works on the address numerics and not the other chars. So when you input your street number and postcode (at least outside the US) you can put whatever you want in the form as long as numbers match, anything else is thrown away.