AVS Code: Why 'N' not 'W' when name incorrect? And why then approved on CVV2 code 'M'?

[WBS]

Hi there,

I had a transaction go through when the customer used the wrong name, address and postal code (website glitch). Drupal Commerce payment details posted below.

The PayPal AVS message said 'nothing matches' and 'transaction declined', but the AVS code was 'N' (no match for address or postal code) rather than 'W' (no match for name, address or postal code).

Why wasn't the AVS code 'W' ?

Then, the CVV2 code was 'M' because the customer entered it correctly -- and the transaction was approved!!!

Does not this mean that a person in possession of a stolen card can use it through WPP without knowing the address at all? Or could enter just the card number and CVV if known even without the cardholder's name?

Thanks,

Nick

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Transaction ID 222

Order 293

Payment method PayPal WPP - Credit Card

Remote ID  XXX

Message Authorization and capture - Success
AVS response: Nothing matched; transaction declined
CVV2 match: Match

Amount $0.01

Status Success

Remote status Sale

Created Mon, 01/12/2015 - 01:50

Payload

Array
(
    [1421056231] => Array
        (
            [TIMESTAMP] => 2015-01-12T09:50:34Z
            [CORRELATIONID] => dfb6941d10a4
            [ACK] => Success
            [VERSION] => 76.0
            [BUILD] => 14726230
            [AMT] => 0.01
            [CURRENCYCODE] => USD
            [AVSCODE] => N
            [CVV2MATCH] => M
            [TRANSACTIONID] => [...]33N
        )

)