Card-not-present fraud (CNP fraud) is the unauthorized use of payment card data in a transaction where neither the card nor the cardholder is physically present at the point of sale, as in online checkout, mail order, telephone order and recurring billing. In e-commerce payment security it is the dominant form of card fraud, because the merchant must accept the payment on the basis of data that can be copied, bought or guessed rather than on a chip that is hard to clone.
The term covers both the attack and the transaction category it exploits. Card networks classify such payments as card-not-present (CNP) transactions, and the rules that decide who bears the loss for them differ sharply from those that apply in a physical store.
How card-not-present fraud works
Card-not-present fraud works because a remote merchant can verify only what the buyer types, not what the buyer holds. In a store, an EMV chip generates a one-time cryptogram for each payment, so copied data alone is nearly useless. Online, the primary account number (PAN), expiry date, CVV and billing address are static values, and anyone who knows them can submit them.
A typical attack follows a supply chain of stolen data. Criminals harvest card details through phishing, malware, database breaches or digital skimming scripts injected into checkout pages. The data is sold in bulk, validated through small test payments, and finally monetized by buying goods that are easy to resell, such as electronics, gift cards or digital vouchers.
The following table maps the main stages of an attack to the controls that interrupt each stage.
| Stage | What the attacker does | Typical control |
|---|---|---|
| Data theft | Phishing, breaches, checkout skimming scripts | PCI DSS controls, script integrity monitoring |
| Validation | Small test charges on many cards | Velocity checks, bot detection, CAPTCHA on retries |
| Monetization | Orders of resalable goods to drop addresses | Fraud risk scoring, address checks, manual review |
| Cash-out | Resale, reshipping, gift card laundering | Delivery verification, issuer monitoring |
| Dispute | Real cardholder reports the charge | Chargeback handling and representment |
Variants of CNP fraud
CNP fraud is an umbrella term for several schemes that share the remote channel but differ in who commits them and how. Distinguishing them matters because each calls for a different control and a different dispute strategy.
| Variant | Mechanism | Main signal |
|---|---|---|
| Stolen card fraud | Third party uses complete stolen card data | Mismatch between device, location and billing data |
| Card testing | Bots try many cards with tiny amounts | Bursts of low-value declines from few sources |
| Account takeover | Attacker logs into a real customer account with a saved card | New device, changed password or address |
| Synthetic identity fraud | Fabricated identity obtains a genuine card | Thin history, new email and phone |
| Friendly fraud | Real cardholder disputes a purchase they made | Disputes after confirmed delivery |
| Triangulation fraud | Fake storefront collects orders and pays with stolen cards | Legitimate-looking orders with mismatched payers |
Friendly fraud is sometimes excluded from strict definitions because the card is used by its legitimate owner. Merchants still group it with CNP fraud in practice, since it produces the same chargeback and the same loss.
Liability for CNP fraud and the role of 3-D Secure
In a card-not-present transaction, the merchant usually bears the fraud loss by default. When the true cardholder disputes the charge, the issuer files a chargeback, and the merchant loses the goods, the revenue and a chargeback fee, while repeated disputes raise its standing with the card networks.
3-D Secure (EMV 3DS, marketed under various network brand names) changes this balance. The issuer authenticates the cardholder, often silently through risk-based authentication using device and behavioral data, or with a one-time code or app confirmation. A successfully authenticated payment normally produces a liability shift to the issuer for fraud-related disputes.
In the European Economic Area, the PSD2 strong customer authentication rules require two independent factors for most online card payments, with exemptions for low-value payments, merchant-initiated recurring charges and transactions that pass transaction risk analysis. Outside such mandates, 3DS is optional and merchants decide where the extra step is worth the conversion cost.
| Situation | Usual liable party | Note |
|---|---|---|
| No authentication used | Merchant | Default rule for remote payments |
| Fully authenticated with 3DS | Issuer | Liability shift for fraud disputes |
| Exemption requested by merchant or acquirer | Merchant or acquirer | Speed gained, protection given up |
| Friendly fraud dispute | Depends on evidence | Liability shift often does not cover it |
How merchants detect and prevent CNP fraud
Effective prevention is layered: no single check stops card-not-present fraud, but each removes a slice of risk at a known cost in friction. Most merchants combine data verification, behavioral signals and authentication, then route uncertain orders to manual review.
- CVV verification proves the buyer saw the card or a copy of it; merchants may not store the CVV after authorization.
- Address verification service (AVS) compares the numeric parts of the billing address with issuer records, with limited coverage outside a few countries.
- Velocity checks limit attempts per card, device, IP address or email within a time window, which is the main defense against card testing.
- Fraud risk scoring combines hundreds of signals, often with machine learning, into a score that triggers approve, review, authenticate or decline.
- Network tokenization replaces the PAN with a merchant-specific token, so a breach of stored credentials exposes far less usable data.
The table below summarizes what each control catches and where it falls short.
| Control | Effective against | Weak against |
|---|---|---|
| CVV check | Bare PAN lists without security code | Full card data from phishing or skimming |
| AVS | Wrong billing address | Fraudsters with full identity data |
| Velocity rules | Card testing and bulk attacks | Slow, distributed attacks |
| Device fingerprinting | Repeat attackers on one device | Emulators and residential proxies |
| 3-D Secure | Stolen card data | Account takeover with phone access |
Common mistakes in managing CNP fraud
The most expensive mistake is optimizing only the fraud rate. Overly strict rules decline good customers, and these false declines often cost more revenue than the fraud they prevent, partly because a rejected customer may never return.
Other recurring errors include treating every chargeback as fraud, which hides friendly fraud and fulfillment problems; ignoring low-value declines, which are the first sign of card testing; and assuming a liability shift covers every dispute. Merchants should track fraud rate, chargeback ratio, approval rate and review rate together, because improving one at the expense of the others rarely improves profit.
The idea in brief
Card-not-present fraud happens when someone pays online or over the phone with card details that are not theirs. The shop never sees the plastic card, only the numbers typed into a form, and numbers can be stolen and copied far more easily than a chip card.
Think of it like a delivery order placed under someone else’s name: the restaurant cannot see who is calling. Shops protect themselves by checking whether the details fit together, by watching for unusual patterns and by asking the bank to confirm the buyer. The key point is that the online shop usually pays for the loss unless the bank confirmed the buyer.
A practical scenario
An online electronics retailer notices one night that its checkout has processed about 2,000 authorization attempts of one or two dollars within an hour, most of them declined. The pattern is classic card testing: a bot is checking which stolen cards still work before using them for larger purchases elsewhere or on the same store.
The payments team adds a velocity limit of three attempts per device and five per IP range per hour, requires 3-D Secure for orders above a set value shipped to a new address, and enables a challenge on repeated failed payments. Over the following weeks, the test traffic disappears and fraud-related chargebacks fall, while the approval rate for returning customers stays unchanged because trusted buyers still pass through without extra steps.