If you include the user's street and zip in your request, the API will return an AVS response automatically.
A sample piece of our NVP:
$nvpStr .= '&FIRSTNAME='.$firstName.'&LASTNAME='.$lastName.'&STREET='.$street.'&CITY='.$city.'&STATE='.$state.'&ZIP='.$zip.'&COUNTRY='.$countryCode;
In your response array, you will have $resArray['AVSADDR']
and $resArray['AVSZIP']
. It will send a Y/N/empty value for each. Only "N" means it does not match. A blank response isn't necessarily a failure. I recommend reading the Developer's Guide for more information on that matter: https://cms.paypal.com/cms_content/US/en_US/files/developer/PP_PayflowPro_Guide.pdf
Some things to keep in mind are:
If either or both the 'AVSADDR'
and 'AVSZIP'
return "N" it will still process the transaction. It's up to you to check and make sure the credentials are correct, unless you are using PayPal's fraud protection (not included). Even still, it's a good idea to do so.
If you the auth/delayed capture method, you can check the 'AVSADDR'
and 'AVSZIP'
during authorization without having to charge anything to the user's CC to verify.
In case you're not already, it's a good idea to also check the 'CVV2MATCH'
by adding '&CVV2='
to your NVP.
If you are in 'sandbox' mode, using certain numbers in the CVV2, Address, and ZIP will trigger a "Y", "N", or blank response, depending on which values you use. These are listed in the PDF file.