Card Not Present Fraud: Prevention, Liability, Control Map

Card-not-present (CNP) fraud is the unauthorized use of payment credentials in a transaction where the physical card is not presented to the merchant, such as an online, phone, or mail-order purchase. CNP transactions, also called card-not-present payments, differ from card-present transactions, where the card is read at a terminal and card present fraud involves a physical card. Because the merchant cannot inspect the card or the cardholder, a CNP fraud chargeback usually lands on the merchant unless authentication shifted liability to the issuer.

Card-not-present describes the payment channel, not every reason a customer might dispute a purchase. A missing delivery, duplicate charge, or canceled subscription can produce a dispute without stolen-card fraud. Keep unauthorized payments separate from service problems and friendly fraud when analyzing losses, and do not infer intent from a claim alone.

{{cta}}

Card-Present vs Card-Not-Present Fraud: Who Bears the Loss

In a card-present payment, the chip, PIN, or contactless tap verifies the card at the terminal. A CNP payment has no equivalent physical check, so the controls on this page stand in for it.

Common card-not-present transactions include:

• Online checkout and in-app purchases
• Phone and mail orders
• Subscription renewals and other recurring charges
• Saved-card (card-on-file) payments
• Orders paid online and picked up in store

UK Finance recorded £423.5 million of remote purchase (card-not-present) fraud losses in 2025, 71.2% of unauthorized card fraud losses, across about 3.2 million cases averaging £132 each.

Understand the Main Card-Not-Present Fraud Paths

First-party misuse belongs in your broader dispute strategy, but should not be counted automatically as stolen-card fraud. The payment fraud guide helps separate payment abuse from billing and fulfillment errors that require different fixes. Card testing and BIN attack fraud both rely on automated attempts, so they call for attempt-pattern monitoring rather than review of individual orders.

Use Signals Together Instead of Treating Them as Proof

Review unusual payment attempts, abrupt changes in order value, account changes, delivery redirection, and repeated failures in context. A new device or different shipping address can be legitimate. Gifts, travel, and shared households make rigid single-signal rules prone to blocking good customers. An address verification service result and a card verification code check are context for review, not conclusive proof of identity. Stripe’s guidance on AVS and CVC verification describes them as checks to weigh with other information.

Compare each signal with the transaction and account history. A sudden burst of attempts followed by an expensive order warrants a different response from an established customer sending a gift. Document the reason for manual review so support can explain delays without exposing internal fraud thresholds.

Investigate account takeover when a familiar account behaves unusually. A long customer history is useful context, but it does not make a compromised session safe. Likewise, triangulation fraud can involve an innocent delivery recipient who did not place the order directly with your store.

Layer Controls Across the Payment Journey

These layers work best inside a wider ecommerce fraud prevention program. The OWASP authentication guidance supports account protections such as multifactor authentication and reauthentication for sensitive actions. These controls complement payment checks; a successful login and a card authorization answer different questions. For automated abuse, Stripe’s card-testing prevention guidance covers defensive controls. Count card-testing attempts separately from settled fraudulent charges, because an attempt is not the same as a completed payment. Alert networks add a post-purchase layer: Mastercard reports that Ethoca Alerts prevented 39 million chargebacks in 2025.

Protect the payment data itself. The PCI Security Standards Council guidance on card verification codes states that these codes must not be stored after authorization. Preserve the permitted verification result through your provider, not the security code as a future evidence attachment.

Match CNP Controls to the Failure They Address

Each control covers a different failure, and none removes risk entirely. Use the table to decide which record to keep for each risk path and where the control stops.

Understand What Authentication Does and Does Not Cover

Authentication can affect liability for eligible fraud disputes, but treatment depends on the specific transaction and rules. Check the recorded outcome, eligibility, and any exceptions. Do not describe all 3D Secure attempts, exemptions, or frictionless payments as carrying identical protection, and do not assume 3D Secure protects every CNP dispute. See the guide to 3D Secure 2 chargebacks for how outcomes differ.

Merchants using Stripe can review its 3D Secure authentication flow to understand the relevant transaction states. Authentication does not establish that goods arrived, a service matched its description, or a cancellation was handled correctly.

Keep fulfillment controls proportionate to the remaining risk. A post-authorization review can be useful before goods leave the warehouse, but your team needs an exception process for legitimate customers. Measure declined good orders and review delays alongside fraud losses when adjusting rules, since fraud false positives cost real sales.

Respond to a CNP Dispute Based on the Claim

Read the chargeback reason code and check the case deadline. If the payment was genuinely unauthorized, a delivery record alone may not support a challenge. Evaluate the facts and applicable liability treatment instead of responding automatically to every case with proof of shipment.

CNP fraud claims arrive under network-specific reason codes, and the code decides which rules and evidence apply.

Code names and numbers change over time, so confirm them in your processor’s dispute documentation.

For a supported response, connect the transaction, relevant authentication result, customer communication, and claim-specific records. The chargeback evidence sources map shows where each record comes from and how the records join. Follow the evidence standardization workflow to create a readable packet. Explain what each record establishes and avoid unsupported statements about customer intent. Name one owner for case submission, such as the disputes lead, whether the packet is assembled manually or with automation, so every case has a single accountable submitter.

For Visa 10.4 disputes, Visa Compelling Evidence 3.0 lets you show two earlier undisputed transactions on the same card, made 120 to 365 days before the disputed one, that share data such as an IP address or device ID plus a shipping address or account ID. That history can support a successful response, so keep device, IP, and account identifiers with every order. Requirements vary by processor, so confirm them with your acquirer.

If the claim concerns nonreceipt or a service problem, investigate that issue directly. If a refund was already issued, reconcile its status before taking another financial action. The appropriate response may be to resolve a valid complaint rather than defend an incorrect charge.

Fraud-coded disputes are a growing cost and a monitoring risk. Mastercard reports that around 45% of merchant chargeback volume globally is fraudulent, both third-party and first-party (2025 data), and forecasts that global chargeback costs to merchants will rise from $36.9 billion in 2026 to $46.1 billion in 2029, based on Datos Insights research. Under the Visa Acquirer Monitoring Program, fraud reports and disputes both feed the merchant ratio, and the Excessive threshold is 1.5% from April 2026. Mastercard’s Excessive Fraud Merchant program targets card-not-present merchants with at least 1,000 monthly sales, $50,000 in fraud chargebacks under code 4837, a fraud ratio of 0.5% or more, and low 3D Secure usage; see the guide to Mastercard chargeback monitoring programs.

Measure Prevention and Recovery Separately

Track attempted fraud, confirmed unauthorized payments, service-related disputes, response completion, and net recovered value as distinct measures. A prevention rule that blocks many legitimate buyers can reduce dispute counts while harming the business. Compare similar channels and customer groups before expanding a rule.

Use the multi-account dispute reporting workflow to keep definitions consistent across processors. Review payment approvals, fulfillment holds, refunds, and disputes together so that movement in one metric does not conceal a problem elsewhere. Assign owners for rules, manual review, and disputes as part of your wider merchant fraud protection program.

Chargeflow Prevent scans orders after checkout and before fulfillment, so a risky order can be held or canceled before goods ship. Use chargeback alerts to catch disputes before they become formal chargebacks, and Chargeflow Automation for automated chargeback recovery on the fraud disputes that still arrive. Pick the capability that matches your observed gap and confirm integration coverage; no tool removes the need for accurate fulfillment records and accessible customer support.

{{cta}}

Veelgestelde vragen

What is a card-not-present transaction?

A card-not-present transaction is a payment where the merchant does not see the physical card, such as online checkout, a phone or mail order, a subscription renewal, a saved-card payment, or an online order picked up in store. The merchant relies on entered card details and authentication rather than a chip or PIN read.

Who is liable for card-not-present fraud?

The merchant usually bears the loss on a card-not-present fraud chargeback, because nothing physical was verified. Liability can shift to the issuer when a payment was authenticated with 3D Secure, subject to network rules and eligibility.

What is the difference between card-present and card-not-present fraud?

Card-present fraud involves a physical or counterfeit card read at a terminal and usually falls on the issuer or the party without chip technology. Card-not-present fraud uses card details without the card and usually falls on the merchant.

Is every card-not-present chargeback fraud?

No. Card-not-present chargebacks can concern unauthorized payments, nonreceipt, cancellation, duplicate processing, or other issues. The payment channel does not establish the cause of the dispute.

Does 3D Secure prevent every CNP chargeback?

3D Secure can affect liability for eligible fraud disputes, but does not prevent every chargeback or resolve service and delivery complaints. Check the actual authentication result and applicable conditions.

Does delivery prove a CNP payment was authorized?

Delivery can support fulfillment, but does not independently prove that the cardholder authorized the payment. Unauthorized-payment claims need an assessment of payment and account evidence.

How can card-not-present fraud be prevented?

Layer account security, payment authentication such as 3D Secure, card verification checks such as AVS and the card verification code, rate limits against automated attempts, and review of order changes before fulfillment. No single signal or control guarantees prevention.

Is a billing and shipping mismatch proof of CNP fraud?

A billing and shipping mismatch is a risk signal that can have legitimate explanations, including gifts. Review it with other transaction and account facts.

Kan dreigingsinformatie fraude bij transacties zonder fysieke kaart (CNP) voorkomen?

Threat intelligence can add context to a review, such as whether a device, email, or attempt pattern has been associated with abuse elsewhere. It does not guarantee prevention, so weigh it with account history, authentication results, and order details rather than treating a flag as proof.