So I'm creating a form for users to purchase things from my site, and currently, I have the following fields (all required):

  • Email
  • CC Number
  • CVC
  • Expiry MM/YY
  • Name on Card
  • Billing Postal Code

But I'm curious about the viability of that last one. My payment gateway supports validation of those fields when charging a card, and I'd like as much as possible when validating a payment to prevent fraud. However, in doing a bit of validation research, I came across this very helpful map on the postal code Wikipedia page that details where postal codes of what length are used. And in looking at the map, there are some countries that don't use a postal code, which would likely mean validation based on that may not work as a required field.

Postal Code map of the world

For example, from the looks of the map, Ireland does not seem to have a postal code. Does that mean that postal codes cannot be used to validate credit card transactions there? Clearly if they don't have a postal code, making it a required field seems problematic.

But, in doing the transactions, I'm also going to need to do verification for sales taxes that need to be paid, and Zip/postal code seems like the best way to accomplish this.

Is Postal Code a valid required field when processing credit cards? And if not how can I support international sales with a decent level of fraud prevention, and still be able to calculate sales tax worldwide?

  • You don't need to validate the postcode that's what the payment gateway does as you have no way of knowing if the billing address matches that of the registered card address... Also I believe Ireland uses modern location codes, not postcodes. Commented Oct 27, 2014 at 19:15
  • @bybe Yes, that is what my payment gateway will do. My question is about it being a required field because there are countries that don't use post codes. In these countries, is there some way they usually handle this, or should I not make it a required field, and try and calculate sales tax in a different manner? Commented Oct 27, 2014 at 19:17
  • You can disable those fields when countries that do not have a postcode using JavaScript or CSS. Commented Oct 27, 2014 at 19:19
  • @bybe Yeah. That requires knowing the country they are in though, which would require either an IP lookup or extra user input, which means I won't know if they need zip until they are partway through the form. Is there some other form of verification done in these countries, though, that is similar or replaceable? Commented Oct 27, 2014 at 19:29
  • What's wrong with asking the country? On shopping sites, I don't think I've ever entered just my post code without entering my full (billing) address.
    – MrWhite
    Commented Oct 27, 2014 at 20:07

1 Answer 1


If you're doing business in the United States you're going to need to collect the zip code for credit card processing reasons. It is used as part of the Address Verification System (AVS) which occurs for all non-swiped credit card transactions. By not capturing it, and then providing it when processing the transaction, at the very least you will force the merchant to incur higher processing fees due to the missing zip code. Without the zip code AVS cannot be performed and the risk for that transaction is higher. The merchant account provider passes on their increased costs due to risk to the merchant.

International sales are by their very nature higher risk. Lack of AVS and CVV verification are just two of the reasons for this. The fact that fraud is much more common in most countries outside of the US, especially outside of North America and Western Europe, is part of the business (and a reason why many merchant account providers will not establish a merchant account for merchants who do business outside of the US).

If you're going to so international sales you need to consider limiting the countries you do business with. Not doing business in Asia, Africa, and the Middle East would be good places to eliminate as well as Eastern Europe.

Then focus on other risk factors to create a score that determines if a transaction is higher risk then normal:

  • Was overnight shipping chosen? Higher risk.
  • High ticket items ordered? Higher risk.
  • etc.

As far as calculating tax goes, you shouldn't need the zip code of international users for that. They obviously don't get charged US taxes and if you are collecting international taxes, their town and country should be enough for you to do the necessary math.

  • With my payment gateway, zip is not required but recommended for verification. I definitely want to get it to lower risk. Also, as I state, I will need it for calculating sales tax. As for limiting scope, that isn't really a great option for me. I know I already have customers in Russia and West Africa, and I likely have ones in parts of Asia as well. I'm selling digital goods, so no shipping, and am also only gathering the zip, not the full address. Commented Oct 27, 2014 at 19:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.