Fact-checked by Grok 2 weeks ago

Card-not-present transaction

A card-not-present (CNP) transaction is a payment processed using a credit or debit card where the physical card and cardholder are not present for verification at the point of sale, distinguishing it from in-person transactions that involve swiping, inserting, or tapping a card.^[1] These transactions commonly occur in remote settings such as online purchases, phone orders, mail orders, or through virtual cards, where the cardholder manually enters details like the card number, expiration date, and security code (CVV).^[2] CNP transactions enable convenient e-commerce and non-face-to-face commerce but rely on digital transmission of sensitive data, increasing vulnerability to unauthorized access compared to card-present methods.^[3] CNP transactions have become a cornerstone of modern commerce, particularly in the digital economy, with their volume surging due to the growth of online retail and mobile payments. In the United States, the value of CNP transactions on major payment networks expanded from approximately $360 billion in 2011 to $1.8 trillion in 2021, reflecting their integral role in facilitating remote sales.^[1] Nearly 50% of Visa's global e-commerce transactions now incorporate tokenization—a security technique that replaces card details with unique identifiers—to support secure CNP processing.^[3] This growth has been accelerated by the shift to chip-based cards (EMV migration starting in 2015), which reduced fraud in physical transactions but shifted more illicit activity toward CNP channels.^[1] Despite their efficiency, CNP transactions carry elevated fraud risks because merchants cannot physically inspect the card or verify the cardholder's identity in real time, making them susceptible to stolen card details, account takeovers, and synthetic identity fraud.^[2] As of 2023, the average fraud rate for debit card CNP transactions in the U.S. reached 41.6 basis points (the value of fraudulent transactions divided by total CNP transaction value), up from 26.1 basis points in 2019, with merchants absorbing the majority of losses on certain networks.^[1] As of 2024, U.S. CNP fraud losses reached $10.16 billion, comprising 74% of all card payment fraud.^[4] Tokenized CNP transactions, however, have demonstrated a 30% reduction in fraud rates compared to those using primary account numbers, highlighting the impact of advanced protections.^[3] To mitigate these risks, industry standards emphasize multi-layered security measures, including address verification services (AVS), CVV checks, and protocols like 3D Secure for added authentication during online purchases.^[2] Tokenization further enhances safety by limiting the exposure of actual card data, improving authorization rates by over 3% in CNP scenarios and contributing to a global 4.6% uplift in approvals.^[3] Real-time monitoring, machine learning-based fraud detection, and regulatory frameworks such as Regulation II (on debit card interchange fees and routing) also play key roles in balancing innovation with security in CNP environments.^[1]

Definition and Characteristics

Definition

A card-not-present (CNP) transaction is a type of payment where the physical credit or debit card is not presented to the merchant at the point of sale, distinguishing it from traditional in-person purchases that require the card's physical presence.^[5] Instead, the cardholder transmits essential card details—such as the account number, expiration date, and card verification value (CVV)—remotely to authorize the payment.^[6]^[7] At its core, a CNP transaction involves an authorization process routed through major payment networks like Visa or Mastercard, where the merchant's acquiring bank submits the provided card details to the card issuer for validation and approval.^[8]^[9] This process does not utilize physical interaction mechanisms, such as magnetic stripe readers, EMV chip interfaces, or PIN verification, relying entirely on the digital or verbal exchange of information.^[10] Typical scenarios for CNP transactions include a customer inputting card details directly into an e-commerce website's payment form or verbally providing them to a merchant over the phone.^[11] In contrast to card-present transactions, which involve the card's physical handling and often additional in-person authentication, CNP methods prioritize remote convenience but depend heavily on the accuracy and security of the shared details.^[11]

Key Characteristics

Card-not-present (CNP) transactions fundamentally rely on the electronic transmission of key cardholder data, including the primary account number (PAN), expiration date, and card verification value (CVV), without any physical inspection or presentation of the card itself.^[12] This data is captured by the merchant through remote channels such as online forms or verbal communication and submitted for verification, distinguishing CNP from in-person payments that involve chip, magnetic stripe, or contactless reading.^[13] The absence of physical verification heightens the transaction's vulnerability, as fraudsters can exploit stolen credentials alone to initiate unauthorized purchases.^[14] Due to this elevated risk profile from lacking direct card inspection, CNP transactions incur higher interchange fees compared to card-present equivalents, reflecting the increased potential for fraud and chargebacks.^[15] For instance, Visa's standard CNP rates for consumer credit cards often range from 1.65% plus $0.10 to 2.60% plus $0.10 as of October 2025, adjusted for factors like e-commerce specifics or incentives for secure practices.^[15] These fees compensate issuers for bearing greater liability in approving transactions without tangible card evidence.^[8] The operational processing flow for CNP transactions begins with the merchant capturing the requisite card details and initiating an authorization request.^[8] This request is forwarded to the merchant's acquirer, which routes it through the payment network (such as Visa or Mastercard) to the card issuer for approval or decline based on available funds, fraud checks, and account status.^[8] Upon issuer response, the acquirer notifies the merchant, enabling completion of the sale if approved; subsequent steps like clearing and settlement follow standard network protocols.^[16] Specific data elements, including indicators for cardholder absence (e.g., DE 61 subfield 4 set to 4 or 5 in Mastercard messaging), ensure the network recognizes the transaction as CNP.^[8]

Comparison to Card-Present Transactions

Card-present transactions occur when the physical payment card is presented to the merchant at the point of sale, typically involving the use of an EMV chip for secure data transmission, along with verification methods such as a personal identification number (PIN) or signature to authenticate the cardholder's identity.^[17] This process generates a unique transaction code for each purchase, significantly reducing the risk of card skimming and counterfeiting compared to older magnetic stripe methods.^[18] The physical presence of the card and cardholder allows for real-time interaction via payment terminals, enabling immediate verification and lowering the overall fraud potential.^[19] In contrast, card-not-present transactions do not involve the physical card or direct cardholder presence, relying instead on remotely provided card details such as the number, expiration date, and card verification value (CVV), without access to EMV chip, PIN, or signature verification.^[2] This absence of physical safeguards heightens fraud exposure, as malicious actors can more easily exploit stolen card information through methods like phishing or data breaches, leading to elevated chargeback rates and financial losses for merchants.^[20] However, CNP transactions provide substantial convenience by enabling remote purchases, such as online shopping or phone orders, which support the growth of e-commerce without requiring in-person interactions.^[21] Due to the increased risk profile of CNP transactions, merchants typically face higher processing fees, with interchange rates often 0.5% to 1% greater than those for card-present transactions to account for elevated fraud and dispute liabilities.^[22] For example, while card-present fees might average around 1.5% to 2.5% plus a fixed amount, CNP fees can rise to 2% to 3.5% or more, depending on the card network and merchant category, reflecting the additional costs of enhanced fraud monitoring and prevention tools.^[23] This fee differential underscores the trade-off between security in physical settings and the flexibility of digital commerce.^[24]

Types of Transactions

Online Transactions

Online transactions represent a primary category of card-not-present (CNP) transactions, where consumers complete purchases over the internet without physically presenting their payment card. These transactions have surged in prevalence alongside the expansion of e-commerce, becoming a dominant form of card payments. By 2021, CNP transactions accounted for 61% of the value of non-prepaid debit card transactions on major dual-message card networks such as Visa and Mastercard in the United States, reflecting their integral role in digital commerce.^[1] The typical process for online CNP transactions begins with the consumer selecting items on a merchant's website or app, leading to a secure checkout page compliant with Payment Card Industry Data Security Standard (PCI DSS) requirements. During checkout, the buyer enters card details, which are then tokenized—a security measure that replaces sensitive information like the primary account number (PAN) with a unique, non-sensitive identifier or token. This token is used for the authorization request sent to the card issuer via the payment network, minimizing exposure of actual card data during transmission and storage.^[25] Common examples of online CNP transactions include retail purchases on platforms like Amazon, where users enter card information at checkout for immediate delivery, or ride-sharing services like Uber, where payments are processed in-app for on-demand transportation without card presentation. These scenarios highlight the convenience of online CNP, enabling seamless global e-commerce while relying on digital verification methods.

Mail Order and Telephone Order Transactions

Mail Order and Telephone Order (MOTO) transactions represent a traditional subset of card-not-present (CNP) payments, characterized by the absence of physical card presentation and reliance on non-digital transmission of payment details. In mail order scenarios, customers provide their credit or debit card information—such as the card number, expiration date, and CVV—through postal mail or fax transmission to the merchant. Telephone order transactions, by contrast, involve the customer verbally sharing these details over the phone, often during a sales call or customer service interaction. This verbal or written provision distinguishes MOTO from other CNP methods by emphasizing direct, non-electronic communication.^[26]^[27] The concept of remote commerce via mail order dates to the mid-19th century, with pioneering examples including Tiffany & Co.'s 1845 Blue Book, which offered catalog-based sales with mail payments, and Aaron Montgomery Ward's 1872 catalog, which popularized rural purchasing via post. Card-based MOTO transactions emerged in the mid-20th century with the widespread adoption of credit cards. Throughout the 20th century, these methods expanded with the growth of telemarketing and printed catalogs, allowing businesses to conduct sales without requiring customers' physical presence at a store. While the rise of e-commerce has diminished their dominance, MOTO persists in niche applications, such as charitable donations via phone pledges, subscription renewals for print media, and payments for in-person services like restaurant takeout orders placed remotely. In the UK alone, MOTO accounts for over 500 million transactions annually, underscoring its ongoing relevance for businesses lacking robust online infrastructure.^[28]^[29]^[30] Processing MOTO transactions requires merchants or agents to manually key in the provided card details into a virtual terminal or payment gateway, a step that inherently elevates the potential for errors compared to automated digital entry. Human input errors, such as transposing digits in card numbers or misrecording expiration dates, can result in transaction failures, necessitating re-entry and delaying fulfillment. These inaccuracies contribute to higher operational overheads, including increased decline rates and the need for follow-up customer communications, making MOTO processing more labor-intensive than card-present alternatives.^[31]^[32]^[30]

Recurring and Installment Transactions

Recurring transactions in card-not-present (CNP) contexts involve automated, periodic charges to a cardholder's account for ongoing goods or services, typically under a pre-arranged subscription agreement. These payments rely on stored payment credentials, such as the primary account number (PAN) and expiration date, which merchants securely retain after an initial authorization.^[33]^[34] Common examples include fixed monthly subscriptions for streaming services like Netflix or gym memberships, where card details are collected during signup via online forms without physical card presentation.^[13] The process begins with a cardholder-initiated transaction (CIT) requiring explicit consent and often strong customer authentication (SCA), followed by merchant-initiated transactions (MIT) for subsequent billings at fixed intervals, such as monthly or annually.^[33] Merchants must disclose billing frequency, amounts, and cancellation terms in a written or electronic agreement, and provide easy revocation options, such as online portals.^[34] Under payment network rules, recurring CNP authorizations mandate initial cardholder consent for future charges, documented via signed contracts or click-to-accept mechanisms, with no storage of sensitive verification codes like CVV2 after the first transaction to comply with PCI DSS standards.^[35]^[33] Subsequent charges use stored credentials with specific indicators in authorization messages, and issuers cannot decline them solely for lacking an expiration date if previously provided.^[34] Limits on amount changes require merchants to notify cardholders at least seven days in advance for any variations, such as price adjustments, ensuring they align with the original consent scope to avoid disputes.^[33] Acquirers must register merchants for services like Automatic Billing Updater to handle credential updates, querying issuers every 180 days for changes in card details.^[33] Installment transactions in CNP settings allow cardholders to split a single purchase into a series of fixed payments over a defined period, often facilitated through buy-now-pay-later (BNPL) services. These differ from recurring payments by having a predetermined end date and total amount, typically for one-time purchases like electronics or travel bookings.^[33] Examples include BNPL providers like Affirm, where an online shopper selects installment options during checkout, authorizing the full amount initially while the provider handles deferred payments in equal parts, such as four interest-free bi-weekly installments.^[36] The authorization process involves an initial CNP transaction with SCA, followed by either a single upfront approval covering all installments or separate authorizations per payment, using stored credentials under a binding agreement.^[34] Merchants receive the full purchase price immediately from the BNPL provider, who assumes the repayment risk, while cardholders consent to the schedule without mid-plan alterations unless renegotiated.^[33] For both recurring and installment CNP transactions, consent must be explicit and revocable, with full disclosure of terms including total costs, payment frequency, and any fees, often presented via e-commerce screens or order forms.^[34] No interest or finance charges are permitted on the card portion in standard setups, and receipts must detail installment numbers or recurring cycles for transparency.^[33] Compliance with these rules ensures chargeback protections, such as unlimited timelines for preauthorized disputes, while prohibiting unauthorized storage of full-track data or verification values post-initial use.^[35]^[34]

Historical Development

Early Origins

Card-not-present (CNP) transactions originated in the 1960s and 1970s, primarily through mail-order catalogs that facilitated credit card payments for goods without requiring the physical presentation of the card.^[37] As bank-issued credit cards proliferated following the introduction of general-purpose cards in the 1950s, mail-order businesses like Sears and Montgomery Ward integrated them into their operations, allowing customers to submit card details via order forms sent through the postal system.^[37] This shift was driven by the centralization of financial accounts via computers, which increased the volume of credit card transactions processed through the mail, contributing to a surge in overall mail pieces from 27.7 billion in 1940 to 63.7 billion by 1960.^[37] A pivotal development occurred in the mid-1970s with the establishment of universal card networks, exemplified by the rebranding of BankAmericard to Visa in 1976.^[38] This network, building on earlier electronic authorization systems like Visa's BASE I launched in 1973, enabled merchants to verify remote transactions by phoning central authorization centers, streamlining CNP processing for mail and telephone orders.^[39]^[38] Prior to widespread electronic systems, authorizations relied on manual telephone calls or paper-based approvals, which supported the growing demand from catalog retailers but exposed vulnerabilities in verification.^[38] From the outset, mail-order CNP transactions faced significant fraud risks, predating computerized detection methods and relying on rudimentary checks like address verification.^[40] Fraud losses escalated rapidly, rising from $20 million in 1966 to $100 million in 1969, often involving stolen card details submitted via mail for unauthorized purchases.^[40] These early vulnerabilities highlighted the challenges of remote payments in an era of limited real-time oversight, setting the stage for ongoing security concerns in CNP environments.^[40]

Growth with Digital Commerce

The surge in card-not-present (CNP) transactions began in the 1990s alongside the explosive growth of e-commerce, fueled by the widespread adoption of the internet and the emergence of pioneering online platforms. eBay's launch in 1995 introduced a marketplace for remote buying and selling, where buyers entered card details without physical presentation, marking a pivotal shift toward digital commerce.^[41] This era's innovations, including secure online payment gateways, enabled businesses to reach global audiences, transforming CNP from niche applications like mail orders into a cornerstone of retail. By the early 2000s, platforms like Amazon had normalized CNP for everyday purchases, laying the groundwork for exponential expansion.^[42] The proliferation of mobile technologies post-2010 further accelerated CNP adoption, integrating seamless remote payment options into smartphones and apps. Apple Pay's introduction in 2014 exemplified this trend, supporting CNP modes for online and in-app transactions through tokenized credentials and biometric authentication, which reduced friction while maintaining security.^[43] Similarly, contactless remote features in services like Google Pay and Samsung Pay expanded CNP's reach, allowing users to complete purchases without proximity to merchants. This mobile-driven evolution not only boosted transaction speeds but also broadened accessibility, with digital wallets facilitating over $10 trillion in transactions annually by 2024.^[44] Globally, CNP transactions have seen remarkable growth, particularly in emerging markets where mobile apps have democratized access to digital commerce. From $1.9 trillion in business-to-consumer e-commerce sales in 2014—predominantly CNP—to an estimated $6.8 trillion by 2025, the sector's expansion reflects surging adoption in regions like Asia-Pacific and Latin America.^[45]^[46] In India, for instance, app-based CNP volumes contributed to overall payment transactions doubling from INR 265 trillion in 2023 to projected INR 593 trillion by 2029, driven by widespread smartphone penetration and platforms like UPI-integrated wallets.^[47] By 2025, online transactions, a key CNP subset, accounted for about 63% of global merchant volume, underscoring the dominance of digital channels in modern card payments.^[4]

Risks and Vulnerabilities

Common Fraud Techniques

Card-not-present (CNP) fraud relies on the absence of physical card verification, enabling criminals to exploit stolen or guessed payment details for unauthorized online, mail-order, or telephone transactions. Common techniques target the acquisition and validation of card information without direct access to the physical card.^[48] Phishing involves deceptive emails, websites, or messages that trick users into revealing card numbers, expiration dates, and CVV codes, often by mimicking legitimate retailers or banks. This method is particularly effective for CNP fraud as it allows remote collection of full payment details without physical interaction. Digital skimming, an online variant of traditional skimming, uses malicious code injected into e-commerce sites or checkout pages to capture entered card data in real-time during legitimate transactions.^[49]^[50] Account takeover occurs when fraudsters steal login credentials—often through phishing or keyloggers—to access a user's saved payment methods on merchant sites or digital wallets, enabling unauthorized CNP purchases. This technique leverages existing verified card details stored online, bypassing initial data acquisition.^[51] Friendly fraud, also known as first-party fraud, involves legitimate cardholders initiating or approving a transaction but later disputing it as unauthorized to obtain refunds, exploiting CNP's lack of immediate verification. This is prevalent in digital goods or services where consumers may claim non-receipt or dissatisfaction post-purchase.^[52]^[53] BIN attacks, or enumeration attacks, use the known Bank Identification Number (the first six to eight digits of a card) to systematically generate and test potential full card numbers via small CNP transactions on low-value merchants. Successful tests confirm valid cards for larger fraud schemes. Card testing complements this by submitting micro-transactions to verify stolen card details without triggering alerts, often automated with bots to probe multiple combinations efficiently.^[54]^[55]

Economic and Operational Impacts

Card-not-present (CNP) fraud imposes substantial economic burdens on the global economy, with losses estimated at approximately $24 billion in 2023 (70-80% of total card fraud) and projected to reach $28.1 billion by 2026.^[56]^[57]^[4] According to the Nilson Report, total global card fraud losses reached $33.83 billion in 2023, with CNP representing the majority, and forecasts indicate cumulative losses of $404 billion over the next decade (2024-2033).^[58] Operationally, merchants bear significant costs associated with CNP fraud, including chargeback fees that can equate to 1-2% of total sales for high-risk businesses, encompassing not only direct reimbursement but also administrative expenses and lost revenue from disputed transactions. Additionally, payment processors often require merchants handling CNP transactions to maintain elevated reserves—typically 5-10% of monthly sales volume—to mitigate potential chargeback liabilities, tying up capital and increasing opportunity costs. These expenses strain merchant profitability, particularly for small and medium-sized enterprises reliant on online sales, where chargeback rates for CNP can range from 0.6% to 1%, far exceeding those for card-present transactions.^[4]^[59]^[60] The broader repercussions of CNP fraud extend to consumer behavior and market dynamics, eroding trust in digital payment systems and prompting merchants to offset losses by raising prices across their offerings. Studies indicate that fraud incidents diminish customer confidence, leading to reduced online purchasing and higher abandonment rates during checkout, which further hampers e-commerce growth. Ultimately, these costs are often passed onto consumers through surcharges or inflated product prices, amplifying the economic ripple effects beyond direct victims of fraud.^[61]^[62]^[63]

Fraud Prevention Measures

Authentication Technologies

Authentication technologies play a crucial role in verifying the identity of cardholders during card-not-present (CNP) transactions, where physical cards are not presented, thereby mitigating fraud risks associated with remote payments. These methods enhance security by adding layers of verification beyond basic card details, ensuring that only authorized users can complete transactions. Key technologies include protocols that introduce additional authentication steps, data substitution techniques for sensitive information, and advanced biometric integrations. EMV 3-D Secure (EMV 3DS) is a standardized protocol developed to authenticate consumers in e-commerce environments, specifically targeting CNP fraud prevention. It operates across three domains: the merchant (acquirer domain), the card issuer (issuer domain), and the interoperability domain managed by networks like Visa and Mastercard. In practice, when a consumer initiates an online purchase, the merchant's system sends transaction details to the issuer via the 3DS protocol; the issuer then assesses risk and may approve frictionless authentication for low-risk cases or challenge the user for high-risk ones.^[64]^[65] The protocol's challenge authentication step typically requires the cardholder to verify identity using a password, one-time password (OTP) sent via SMS or app, or other methods like security questions. For instance, Verified by Visa (now Visa Secure) and Mastercard SecureCode implement 3DS as branded versions, where users are redirected to an issuer-hosted page to enter credentials, ensuring the transaction cannot proceed without successful verification. EMV 3DS version 2.0 and later versions support numerous data points, including device and behavioral information, to enable more accurate risk-based decisions, reducing unnecessary challenges while maintaining security. This has contributed to significant fraud reductions, with studies indicating lower chargeback rates for authenticated transactions.^[66]^[65]^[64] Tokenization serves as a foundational security measure by replacing sensitive cardholder data, such as the primary account number (PAN), with unique, non-sensitive tokens that have no intrinsic value outside the issuing system's vault. In CNP scenarios, when a merchant processes a payment, the actual card details are never stored or transmitted in full; instead, a token is used, which can only be detokenized by authorized parties to retrieve the original data for authorization. This approach aligns with PCI DSS requirements by limiting the scope of cardholder data environments, thereby reducing compliance burdens and exposure to breaches.^[67]^[68] The PCI Security Standards Council outlines guidelines for tokenization products, emphasizing secure token generation, management, and lifecycle to prevent reverse-engineering or correlation attacks. Services like Visa Token Service exemplify this by provisioning domain-specific tokens for e-commerce, mobile apps, or recurring payments, which enhances security without disrupting user experience. Tokenization has proven effective in curbing CNP fraud, with tokenized transactions showing approximately 30-40% lower fraud rates compared to non-tokenized ones, according to network data.^[69]^[70]^[71] Biometrics and device binding integrate advanced verification into CNP transactions, particularly within mobile apps and browsers, by leveraging inherent user traits and hardware ties for authentication. Biometric methods, such as fingerprint scanning or facial recognition, provide inherence factors under standards like PSD2's Strong Customer Authentication (SCA), where the issuer prompts the user during high-risk 3DS challenges to confirm identity via device sensors. Behavioral biometrics, including typing patterns or swipe gestures, can operate passively in the background to analyze ongoing session legitimacy without user interruption.^[65]^[72] Device binding complements biometrics by cryptographically linking a specific device to the payment credential, ensuring that authentication occurs only on trusted hardware. In EMV 3DS, this is achieved through protocols like FIDO2, where public key cryptography binds the device during enrollment, allowing subsequent authentications to verify both the user (via biometrics) and the device itself. This reduces fraud in app-based CNP payments by preventing credential use on unauthorized devices, with implementations showing improved authorization rates and user convenience.^[73]^[74]

Risk Assessment and Monitoring

Real-time scoring models powered by artificial intelligence are essential for evaluating card-not-present (CNP) transactions during authorization, assigning risk scores based on patterns such as transaction velocity to flag potential fraud instantly. As of 2025, emerging agentic AI technologies are further enhancing these models by autonomously adapting to new threats, contributing to projected global CNP fraud losses of $28.1 billion by 2026.^[75]^[76] These models analyze factors like the frequency of transactions from a single card or IP address within a short timeframe, known as velocity checks, to detect unusual spikes that may indicate testing by fraudsters or account takeovers.^[77] For instance, Visa's generative AI solution processes noisy data in real-time to identify enumeration attacks in CNP scenarios, improving detection accuracy without relying solely on historical patterns.^[75] Similarly, Mastercard's market-ready AI models, trained on global anonymized transaction data, provide robust scoring for issuers and merchants to approve legitimate payments while blocking high-risk ones.^[78] Machine learning techniques enhance anomaly detection in CNP transactions by identifying deviations from normal behavior, such as IP geolocation mismatches where the transaction origin does not align with the cardholder's known location.^[79] These models process vast datasets to spot inconsistencies, including sudden changes in IP addresses that suggest proxy usage or cross-border fraud attempts.^[80] Device fingerprinting complements this by creating unique identifiers from browser attributes, operating system details, and hardware signals, allowing systems to track repeat suspicious devices across sessions even if other identifiers change.^[81] Supervised and unsupervised machine learning algorithms, as applied in payment card fraud detection studies, achieve high precision in flagging such anomalies by learning from labeled historical data and adapting to emerging threats.^[82] Merchants utilize configurable tools to set risk thresholds that trigger manual reviews for high-risk CNP orders, balancing fraud prevention with customer experience.^[83] Fraud scoring systems generate numerical outputs—often on a scale from 0 to 100—where scores above a predefined threshold, such as 75, prompt human intervention to verify details like shipping addresses or contact the cardholder.^[84] These thresholds can be customized based on merchant risk tolerance, order value, or historical fraud rates, with tools from providers like Visa enabling automated flagging for orders exceeding velocity limits or showing geolocation discrepancies.^[85] By routing a small percentage of transactions (often less than 15%) to manual review, merchants reduce false positives while addressing the majority of fraud risks efficiently.^[86]

Regulatory Framework

Key Regulations and Standards

The Payment Card Industry Data Security Standard (PCI DSS) is a globally recognized set of security standards established by the PCI Security Standards Council to protect cardholder data during storage, processing, and transmission, including in card-not-present (CNP) environments such as online and telephone transactions. The current version, PCI DSS v4.0.1 (June 2024), includes updated requirements effective March 31, 2025, such as enhanced multi-factor authentication and scripting controls.^[87] These standards are mandatory for all entities handling payment card information, including CNP processors, merchants, and service providers, requiring measures like network segmentation, access controls, and regular vulnerability assessments to mitigate risks of data breaches. Non-compliance can result in fines, increased transaction fees, or loss of payment processing privileges imposed by card brands like Visa and Mastercard. In the European Union, the Revised Payment Services Directive (PSD2), formally Directive (EU) 2015/2366 adopted in 2015 and entering into force in 2018, mandates strong customer authentication (SCA) for most electronic payments, including CNP transactions, to enhance security and reduce fraud. SCA requires at least two factors of authentication—such as knowledge (e.g., password), possession (e.g., device), and inherence (e.g., biometrics)—for payer-initiated CNP payments exceeding €30, with exemptions for low-value or low-risk transactions subject to regulatory approval. PSD2 also promotes open banking by requiring payment service providers to share customer data securely via APIs, indirectly supporting safer CNP ecosystems while ensuring consumer consent and data protection under GDPR. PSD2 is expected to be replaced by the proposed PSD3 directive, which aims to further enhance security and innovation, with negotiations ongoing as of 2025.^[88] In the United States, the Fair Credit Reporting Act (FCRA), enacted as part of the Consumer Credit Protection Act of 1970 and amended by the Fair and Accurate Credit Transactions Act of 2003, governs the use of consumer credit reports in CNP transactions and provides rights to dispute inaccurate information resulting from fraudulent activity.^[89] Under FCRA, consumers can request free credit reports and dispute erroneous entries, such as those from unauthorized CNP charges, obligating credit bureaus to investigate and correct inaccuracies within 30 days, which helps mitigate identity theft impacts in remote payment scenarios.^[90] Complementing this, the Electronic Fund Transfer Act (EFTA) of 1978, implemented via Regulation E, establishes consumer protections for electronic fund transfers, including debit card CNP transactions, by limiting liability for unauthorized transfers to $50 if reported within 60 days of the statement and requiring financial institutions to investigate and provide provisional credit within 10 business days, with full resolution within 45 calendar days. These U.S. laws ensure timely resolution of CNP-related errors, with consumers protected from full liability for fraudulent electronic transfers reported within 60 days.^[91]

Liability and Dispute Resolution

In card-not-present (CNP) transactions, card issuers bear primary liability for unauthorized fraud under zero-liability policies adopted by major networks such as Visa and Mastercard. These policies protect cardholders from financial responsibility for fraudulent charges made without their knowledge or consent, requiring issuers to reimburse affected accounts promptly, often within five business days. For example, Visa's Zero Liability Policy explicitly covers unauthorized CNP payments, ensuring no cardholder liability as long as they have not been grossly negligent in safeguarding their card details.^[92]^[93] Similarly, Mastercard's policy extends this protection to debit and credit cards used in CNP scenarios, with issuers absorbing the loss unless the cardholder contributed to the fraud through negligence.^[93] The chargeback process serves as the primary mechanism for resolving CNP disputes, allowing cardholders to contest transactions directly with their issuer. Upon filing a dispute—typically for reasons like unauthorized use or non-delivery—the issuer reviews the claim and, if valid, reverses the transaction by debiting the merchant's account through the acquirer, effectively returning funds to the cardholder. Cardholders generally have 60 to 120 days from the transaction date or problem discovery to initiate a chargeback, with Visa and Mastercard standardizing at 120 days for most fraud-related CNP cases, though extensions up to 540 days apply in specific fraud scenarios.^[94]^[95] Merchants receive notification from their acquirer and must respond within 20 to 45 days, depending on the network, or risk automatic loss of the dispute.^[94]^[96] Merchants can mitigate liability in CNP disputes by providing compelling evidence to their acquirer during the representment phase, potentially reversing the chargeback and shifting responsibility back to the issuer. Key protections include documentation of Address Verification Service (AVS) matches, where a full "Y" response (exact billing address alignment) combined with proof of delivery to the verified address strengthens the merchant's case against fraud claims.^[97] Card Verification Value (CVV) confirmations and IP address logs matching the cardholder's location also serve as critical evidence, as outlined in Visa's dispute guidelines, helping merchants avoid liability when authentication tools were properly employed.^[97] Failure to submit such evidence within the response window typically results in the merchant absorbing the loss.^[98]

References

[1]
Card-Not-Present Fraud Rates in the United States After the ...
May 21, 2025 · I define the card-not-present fraud rate as the value of card-not-present fraud divided by the value of card-not-present transactions ( ...
[2]
Card-present vs. card-not-present transactions - Stripe
Feb 25, 2025 · Increased risk of fraud. Since the cardholder is not present during the transaction, it's more difficult for the business to verify the ...
[3]
A Deep Dive into Tokenized Transactions | Visa
Card not Present (CNP) is when the card number is inputted by a means other than F2F. ... Visa credit and debit global card-not-present transactions for tokenized ...<|control11|><|separator|>
[4]
[PDF] US Payments Security Evolution and Strategic Road Map | Mastercard
Dec 11, 2014 · Card-not-present transaction—A transaction that does not require a physical card to be present at the time of purchase, such as for ...
[5]
[PDF] First Data Merchant Services LLC: Stipulated Order for Permanent ...
May 20, 2020 · C. "Card-Not-Present Transaction" means a debit or credit card transaction whereby the. Person's debit or credit card is not physically swiped ...
[6]
[PDF] Glossary of Payment and Information Security Terms
... card and is used as an additional check to ensure that the card is in possession of the legitimate cardholder, typically during a card-not-present transaction.
[7]
[PDF] Transaction Processing Rules | Mastercard
Jun 10, 2025 · Card-Not-Present Transaction Declines ... definition file (IDF) input documents no later than five business days prior to the requested.
[8]
[PDF] Authorization and Reversal Processing Requirements for Merchants
Important: The first estimated authorization determines the final transaction characteristics (i.e., whether a transaction took place in a card-present or a ...
[9]
[PDF] PCI DSS Applicability in an EMV Environment
Oct 5, 2010 · globally adopted robust authentication process for card-not-present (CNP) transactions, the need to keep the PAN and other sensitive ...
[10]
Glossary - PCI Security Standards Council
Methods used by merchants to accept payments from customers. Common payment channels include card present (in person) and card not present (e-commerce and MO/TO) ...
[11]
[PDF] PCI Data Storage Do's and Don'ts
Never store the card-validation code or value (three- or four-digit number printed on the front or back of a payment card used to validate card-not-present ...
[12]
Card-not-present (CNP) transactions explained - Stripe
Jan 22, 2025 · A card-not-present (CNP) transaction is a purchase made remotely, without processing a physical card via a card reader or terminal (and without ...
[13]
Card-Not-Present Transactions: Risks and Best Practices - Rapyd
Apr 22, 2025 · This article breaks down why these transactions carry higher risk, what types of fraud to watch for and how you can protect your business with the right tools ...
[14]
[PDF] Visa USA Interchange Reimbursement Fees
Oct 18, 2025 · Card Not Present Incentives require CPS qualification and are subject to change. EMV Token transactions qualify for Card Not Present Incentive ...
[15]
Card-Not-Present Transactions - Cybersource Developer Center
Typical card-not-present transactions are internet and phone transactions. Card-not-present transactions pose an additional level of risk to your business ...
[16]
Chip-and-PIN vs. Chip-and-Signature Cards: Secure Credit Card ...
The use of an EMV chip, which creates a unique transaction code for each purchase, greatly reduces the risk of skimming and card counterfeiting compared to the ...
[17]
What are EMV chip cards? How EMV works - Stripe
Feb 2, 2023 · To allow the purchase to proceed, the customer must provide either their PIN or their signature, depending on whether the card is a chip-and-PIN ...
[18]
EMV Chip Cards: What You Need To Know About PIN Or Signature
Chip and PIN cards use a PIN for authorization, while chip and signature cards use a signature matched to the card or on file.
[19]
Card-Present vs Card-Not-Present in Payments - Clearly Payments
May 19, 2023 · Card-not-present transactions occur when the payment card is not physically presented during the transaction. Instead, the cardholder's payment ...<|separator|>
[20]
Card Present Vs. Card Not Present - National Processing
Dec 2, 2024 · Card-present transactions generally have lower interchange fees compared to card-not-present purchases, due to their lower risk of fraud.Missing: comparison | Show results with:comparison
[21]
What Are Transaction Fees? Small Business Examples & Tips
Jul 23, 2025 · Card-present transactions (in-store swipes or chip insertions) typically cost 0.5-1% less than card-not-present transactions (online, phone, or ...<|control11|><|separator|>
[22]
Interchange fees: what they are and how they work - Adyen
Nov 2, 2023 · For card-not-present transactions, the fee caps are 1.15% for debit transactions and 1.50% for credit transactions. Guides and reportsUnderstand ...
[23]
Understanding card-present and card-not-present transactions
Aug 29, 2024 · Because card-present transactions are more secure, payment processors usually charge less in credit card processing fees, leaving more of your ...
[24]
What is tokenization? A primer on card tokenization - Mastercard
Mar 19, 2024 · Tokenization is when the number on your payment card is replaced with a ”stand-in” number that is saved in your phone or watch or the ...
[25]
What are MOTO payments? - Stripe
Dec 21, 2023 · MOTO payments happen when a business processes credit or debit card transactions without the physical presence of the card. This is how the ...<|control11|><|separator|>
[26]
Mail Order Telephone Order Moto | Payments Glossary - Nexio
These transactions are classified as card-not-present (CNP) because the merchant does not physically handle the customer's card. Key Features of MOTO Payments.Missing: history | Show results with:history
[27]
MOTO Fraud and Chargebacks: Risks and Prevention Strategies
MOTO transactions have existed in the US since the 19th century. Way back in 1845, Tiffany's Blue Book offered a service that mimicked MOTO. In 1872, Aaron ...
[28]
What is a MOTO Payment? Everything You Need to Know
Oct 30, 2025 · MOTO (Mail Order / Telephone Order) payments are still widely used in the UK, with over 500 million transactions annually. They are ...
[29]
https://payguard.co/what-is-a-moto-payment-everything-you-need-to-know/
[30]
What is MOTO in Payment Processing? - Credit Card Processing ...
Aug 7, 2023 · Because the merchant manually enters the customer's credit card information, there is a higher risk of human error, such as entering the wrong ...
[31]
MOTO Credit Card Risks & Security Tips
Sep 19, 2025 · Manual Entry Errors. Human error is a common occurrence in MOTO setups. Incorrect card numbers, expiration dates, or typos in billing ...
[32]
[PDF] Transaction Processing Rules | Mastercard
Jun 10, 2025 · The Transaction Processing Rules (TPR) manual includes an overview, applicability, and a chapter on connecting to the interchange system and ...
[33]
[PDF] Visa Core Rules and Visa Product and Service Rules
Apr 12, 2025 · The Visa Core Rules and Visa Product and Service Rules govern financial institution clients in the Visa system, covering governance, local ...
[34]
Can card verification codes be stored for card-on-file or recurring ...
No. It is not permitted to retain card verification codes once the specific purchase or transaction for which it was collected has been authorized.Missing: rules | Show results with:rules
[35]
Buy Now, Pay Later (BNPL): What It Is, How It Works, Pros and Cons
Buy Now, Pay Later (BNPL) is a type of short-term loan that lets shoppers pay for products in small installments spread over a set period of time.
[36]
1960s: Reaching out to Industry to Level Mountains of Mail
### Summary of Credit Cards and Mail Order in the 1960s
[37]
Electronic Point-of-Sale Payments | Federal Reserve History
Sep 25, 2024 · Several debit card pilot experiments occurred in the 1960s and 1970s but did not result in much adoption. Debit card payments began to ...Missing: mail- catalogs
[38]
[PDF] VisaNet - The technology behind Visa
In the early 1970s, Visa created one of the world's first electronic credit card authorization systems. Since then, Visa has been continually improving ...Missing: 1976 remote
[39]
United States v. Maze | 414 U.S. 395 (1974)
It was also estimated that, in 1969, 1.5 million cards were lost or stolen, and that losses due to fraud had risen from $20 million in 1966 to $100 million in ...
[40]
History of eCommerce: birth and evolution of the selling method that ...
Dec 9, 2024 · The 1990s were a crucial period for electronic commerce, characterized by rapid growth and numerous launches. In 1994, the first secure online ...
[41]
History of e-commerce: The World Wide Web and e-commerce boom
Dec 21, 2023 · The 1990s brought forth the internet as we know it today, and along with it, long-standing e-commerce platforms like eBay and Amazon.Missing: present | Show results with:present
[42]
Apple celebrates 10 years of Apple Pay
Oct 17, 2024 · Apple's Jennifer Bailey reflects on the ways Apple Pay enriches users' lives, and shares new ways to pay with Apple Pay.
[43]
Apple Pay's 10-Year Journey and Its Next Decade of Decisions
Oct 22, 2024 · From 2022 to 2024, the share of consumers who use mobile wallets for in-store transactions rose 33%, indicating mobile wallet use in-store is ...
[44]
[PDF] Global B2C E-commerce Report 2015 - Ecommerce Europe
Online retail has been booming over the last few years. At $1.9 trillion, global B2C e-commerce sales of goods and services nearly doubled in 2014 in comparison ...
[45]
51 ECommerce Statistics In 2025 (Global And U.S. Data)
Jun 19, 2025 · Ecommerce sales will surpass $6.8 trillion in 2025. There are over 28 million eCommerce stores globally. 52% of online shoppers look for ...
[46]
[PDF] The Indian payments handbook – 2024 – 2029 - PwC India
In terms of value of payment transactions, the market is expected to grow double, from INR 265 trillion to INR 593 trillion over the same period. During FY 2023 ...
[47]
The Ultimate Chargeback Statistics 2025: Trends, Costs, and Solutions
Jun 24, 2025 · Global card-not-present (CNP) fraud losses are estimated to reach $28.1 billion by 2026, a 40% increase from 2023. Consumers disputed up to 105 ...
[48]
Fraud against payment systems | Europol - European Union
Card-not-present fraud involves the unauthorised use of credit or debit data (the card number, billing address, security code and expiry date) to purchase ...Missing: techniques | Show results with:techniques
[49]
[PDF] Advancing fraud protection with global network intelligence
There are many ways a fraudster can gain access to payment card credentials. These include card skimming, phishing, blunt-based bot attacks and account ...
[50]
How card testing and digital skimming are evolving - Mastercard
Oct 8, 2025 · With digital skimming, crooks insert some malicious code into vulnerable areas like online checkouts and come away with all the data they need ...Missing: phishing present
[51]
Payment card fraud - Interpol
Card-Present and Card-Not-Present fraud In addition to actual card theft, criminals use various methods to capture data including card skimming at ATMs or ...
[52]
What every merchant needs to know about friendly fraud
Jun 16, 2022 · What every merchant needs to know about friendly fraud. As card-not-present transactions rise, Visa is addressing the impacts of first party ...
[53]
[PDF] 8 Steps to Efficient Transaction Fraud Monitoring | Mastercard
Card-not-present fraud occurs when a fraudster uses a person's card information, instead of the physical credit card, to make an unauthorised transaction online ...
[54]
What is a BIN Attack? - Experian Insights
the first six to eight digits of a credit or debit ...
[55]
[PDF] Visa Guidance to Guard Against Enumeration Attacks and Account ...
Aug 12, 2021 · Overview: Visa is reminding clients to maintain adequate controls to swiftly detect and block enumeration attacks and account testing schemes.<|control11|><|separator|>
[56]
Card Fraud Losses Worldwide in 2023 - Nilson Report
Card fraud losses worldwide in 2023 were $33.83 billion, with a rate of 6.58¢ per $100 in total volume. US losses were $14.32 billion.Missing: CNP | Show results with:CNP
[57]
Card-Not-Present Fraud Remains a Leading Concern as Payment ...
Aug 5, 2024 · Card payment fraud is driven substantially by CNP fraud. By 2030, CNP fraud is projected to reach an unbelievable $49 billion globally.
[58]
The 2025 Playbook for Preventing Card-Not-Present Fraud
Jan 2, 2025 · The number of CNP crimes has been rising over the years. Nilson also reported that CNP fraud accounted for almost 7 in 10 fraud losses to ...<|control11|><|separator|>
[59]
23+ Chargeback Statistics Every Merchant Should Know for 2025
Feb 25, 2025 · A 2018 study suggests that sellers lose 1.8% of their total revenue from fraud. And Shopify suggests that chargebacks cost merchants 0.47% of ...
[60]
Understanding Merchant Account Reserves for 2025 - PaymentCloud
Jul 7, 2025 · On average, most banks require a reserve of 5-10% of the merchant's expected monthly sales volume. What Merchants Are Required to Have a Reserve ...
[61]
What is card-not-present fraud? What businesses need to know
Mar 14, 2024 · Card-not-present (CNP) fraud is credit card fraud in which the physical card isn't needed to complete a transaction.Missing: takeover friendly BIN
[62]
Fighting Friendly Fraud & Chargeback Fraud in Financial… | Alloy
Apr 9, 2025 · Ultimately, the collective cost of chargeback fraud gets passed on to all consumers through higher prices for goods and services.Missing: pass | Show results with:pass
[63]
Average Credit Card Processing Fees and Costs in 2025
Sep 25, 2025 · Fee variability: Credit card processing fees range from 1.10% to 3.15% per transaction, influenced by card type, merchant category, and payment ...
[64]
EMV® 3-D Secure - EMVCo
EMV 3-D Secure (EMV 3DS) is an e-commerce fraud prevention protocol that helps authenticate consumers and prevent card-not-present fraud.
[65]
3D Secure Authentication: The Complete Guide - ACI Worldwide
The merchant's payments gateway automatically sends transaction details and a 3D Secure verification request to the cardholder's issuing bank. The issuer ...How Do 3ds And 3ds 2.0... · Other Sca Exemptions That... · What Else Should You Know...
[66]
Visa Secure EMV 3-D Secure for Merchants | Visa
Visa Secure is our EMV 3-D Secure program that makes authentication simple, reduces customer friction and helps prevent card-not-present fraud.
[67]
[PDF] Information Supplement • PCI DSS Tokenization Guidelines
The purpose of this Information Supplement is to provide guidance for payment industry stakeholders when developing, evaluating, or implementing a tokenization ...
[68]
Tokenization offers more seamless and secure payments | Visa
Tokenization helps secure digital payments by turning sensitive payment details into unique values called tokens, which can potentially reduce fraud risk.
[69]
[PDF] Tokenization Product Security Guidelines –
With a rising demand for tokenization products, the PCI Security Standards Council (PCI SSC) believes it is imperative to build, test, and deploy products ...
[70]
Visa Token Service
By substituting Visa card numbers with tokens, VTS enables richer, more secure digital payment experiences for millions of customers every day.Value-Added Services · Wallets And Wearables · Tools And Resources
[71]
How EMVCo, FIDO, and W3C Technologies Relate
Dec 13, 2022 · EMV® 3-D Secure enables issuing banks to assess an eCommerce payment transaction and authenticate the cardholder if required. The protocol ...<|control11|><|separator|>
[72]
EMVCo and FIDO Alliance Provide Essential Guidance on Use of ...
Feb 26, 2024 · The FIDO Alliance and EMVCo collaborate to provide guidance on how FIDO authentication can be incorporated in payment use-cases.
[73]
What is New with EMV® 3DS v2.3? - EMVCo
Nov 12, 2021 · EMVCo has updated the EMV 3-D Secure (EMV 3DS) Specifications to support more secure and convenient e-commerce authentication.
[74]
Visa Announces Generative AI-Powered Fraud Solution to Combat ...
May 7, 2024 · Visa's approach uses noisy data to train the highly accurate real time AI model. By evaluating each CNP transaction against enumeration patterns ...
[75]
What is a velocity check in payments? What businesses should know
Aug 30, 2024 · Velocity checks are a fraud prevention method used in payment processing. They work by monitoring the frequency and pattern of transactions ...
[76]
[PDF] The power of today's market‐ready AI to reduce transaction fraud
Market‑ready AI models built for transaction fraud and trained on global anonymized and aggregated data are more robust and experienced than any legacy AI ...
[77]
[PDF] Card-Not-Present (CNP) Fraud Mitigation Techniques
The white paper is intended for payments industry stakeholders who need to understand and make business decisions about implementing technologies that are ...
[78]
Fraud Detection Machine Learning: a “Smart” Move for Retail
Jul 7, 2025 · Machine learning-based fraud detection analyzes data points including transaction details, behavioral indicators, device and network information ...
[79]
Card Not Present Fraud: Prevention & Detection Strategies - FOCAL
Aug 21, 2025 · Learn about the risks of Card Not Present fraud. Explore its types, mechanisms, and 9 detection and prevention strategies for secure online ...
[80]
An intelligent payment card fraud detection system - PubMed Central
Jun 8, 2021 · In this paper, we apply a total of 13 statistical and machine learning models for payment card fraud detection using both publicly available and real ...
[81]
E-Commerce Fraud Prevention: Best Practices for Using Fraud Scores
Feb 28, 2019 · If a merchant manually reviews every order, fraud scores are essential for guiding their team throughout the review and decision process.
[82]
[PDF] Fraud Scoring | U.S. Payments Forum
Fraud scoring is used by merchants, issuers, and/or their processors to assess the level of risk in taking a. CNP order. A fraud score indicates whether an ...Missing: thresholds | Show results with:thresholds
[83]
[PDF] Webinar: Preventing Card-Not-Present Fraud - Visa
Dec 8, 2016 · Studies show that merchants who include CVV2 validation in their authorization procedures for card-absent transactions can reduce their fraud- ...
[84]
How to protect your business from CNP fraud in 2023 - Trulioo
Oct 20, 2022 · Many merchants are adopting measures to detect and prevent CNP fraud to protect their business and bottom line. When a payment becomes a charge- ...Missing: prices | Show results with:prices<|control11|><|separator|>
[85]
Fair Credit Reporting Act - Federal Trade Commission
The Act (Title VI of the Consumer Credit Protection Act) protects information collected by consumer reporting agencies such as credit bureaus, medical ...
[86]
[PDF] A Summary of Your Rights Under the Fair Credit Reporting Act
Inaccurate, incomplete, or unverifiable information must be removed or corrected, usually within 30 days. However, a consumer reporting agency may continue to ...
[87]
Electronic Fund Transfers FAQs
An unauthorized EFT is an EFT from a consumer's account initiated by a person other than the consumer without actual authority to initiate the transfer.
[88]
Zero Liability - Visa
With Visa's Zero Liability Policy, you won't be held responsible for unauthorized transactions made with your Visa card.
[89]
Mastercard Zero Liability Protection for Unauthorized Transactions
Mastercard's Zero Liability policy ensures that you won't be held responsible for any fraudulent or unauthorized transactions made with your credit or debit
[90]
Visa Chargeback Time Limits: The 2025 Guide
Oct 21, 2024 · Cardholders have 120 days to file a dispute. Merchants must respond within 30 days of day one for each phase of the process.
[91]
A Merchant's Guide to Chargeback Time Limits
Feb 19, 2024 · Cardholders have 120 days to file a chargeback for issues related to: Fraud; Late presentment; An incorrect transaction code, currency, account ...
[92]
MasterCard Chargeback Guide: Rules and Time Limits - Justt
30 days to pursue arbitration but not more than 75 days after the second presentment. Note: with VISA, both parties have ten days to pursue arbitration. Their ...
[93]
[PDF] Dispute Management Guidelines for Visa Merchants June 2024
The purpose of this guide is to provide merchants and their back- office sales staff with accurate, up-to-date information to help merchants minimizing the risk ...Missing: CNP | Show results with:CNP
[94]
Visa Chargeback Dispute: Everything You Need to Know in 2025
Aug 25, 2025 · Cardholder: 120 days from the transaction date to file most disputes (exceptions exist, e.g., up to 540 days for certain fraud cases). Merchants ...