Card Not Present Fraud

Online shopping allows customers to purchase products and services from almost anywhere. However, the lack of physical interaction makes it harder for merchants to determine whether a payment is legitimate.

Understanding how card not present fraud works and which preventive measures to apply can help in reducing financial losses, protecting customers and maintaining a secure payment experience.

What Is a Card Not Present Fraud?

Card not present fraud, also called CNP fraud, is a type of payment fraud in which someone uses another person’s card information to make an unauthorized transaction without physically presenting the card to the merchant.

It commonly occurs via e-commerce websites, mobile applications and telephone payments, where the cardholder and merchant are not physically present together. 

For example, a fraudster obtains someone’s credit card number, expiry date and security code through a phishing scam. They then use these details to purchase products online without the cardholder’s permission. However, not every CNP transaction is fraudulent. Most online payments are legitimate. The problem arises when the payment information is used without the cardholder’s authorization. 

How Does Card Not Present Fraud Work?

Fraudsters use different methods to obtain payment details or access accounts with stored cards. The most common include:

Stolen card information 

Criminals obtain card details through phishing, data breaches or compromised websites. They then use the information to make purchases, often targeting expensive products or other easily resold goods. 

Card testing and enumeration

Fraudsters submit numerous payment attempts to identify valid card information. These may involve small transactions or different combinations of card numbers, expiry dates and security codes. Automated scripts can make these attempts faster. This allows criminals to identify usable credentials before attempting large purchases.

Account takeover fraud

In some cases, criminals gain access to existing customer accounts rather than stealing card details directly. If an account already contains a saved payment method, the fraudster may use it to complete purchases. NIST identifies compromised e-commerce accounts as a potential route for fraudulent payments and loyalty programme abuse.

What Are the Warning Signs of CNP Fraud? 

Merchants and card-issuing banks may detect different warning signs because they have access to different transaction information. 

Warning signs merchants should monitor

Merchants can identify suspicious activity through their checkout systems, customer accounts, and payment processor data. 

Common indicators include: 

• Repeated declined payments within a short period. 
• Several cards used from the same device or IP address. 
• Changes to delivery information shortly before a large purchase.
• Mismatch in billing, shipping address, and IP location. 

Warning signs banks and card issuers should monitor 

Banks and card issuers can assess cardholder spending patterns and payment activity across merchants. Potential warning signs include:

• Unusual spending across multiple merchants within a short period.
• Repeated failed authorization attempts involving the same card.
• Transactions inconsistent with the cardholder’s usual spending behaviour.
• Transactions from unusual locations or unfamiliar devices.

Neither merchants nor issuers should treat a single warning sign as proof of fraud. Several indicators may need to be assessed together before additional verification or restrictions are applied. 

How Does CNP Fraud Affect Businesses?

A CNP fraud can result in lost goods or services, investigation costs, and a chargeback after the cardholder disputes the payment. Mastercard states that merchants are typically responsible for losses associated with fraudulent CNP transactions, although the outcome of an individual dispute depends on payment network rules, authentication and the evidence available. 

Fraud can also affect customer confidence. At the same time, overly strict security checks may decline legitimate payments or cause shoppers to abandon purchases. Effective CNP fraud prevention therefore has to balance security with a payment experience to reduce fraudulent transactions while keeping the checkout process manageable for genuine customers.

How to Prevent Card Not Present Fraud 

Merchants can reduce CNP fraud by combining payment security, customer authentication and transaction monitoring. Banks and card issuers provide additional protection through their own authentication and authorization systems. 

Protect payment card information:

Merchants should use secure payment integrations and minimise their handling of sensitive cardholder information. With hosted payment pages, customers enter their card details directly into the payment provider system rather than the merchant’s website.  

The PCI Data Security Standard sets baseline technical and operational requirements for protecting payment account data. Merchants remain responsible for applicable requirements even when processing is outsourced. 

Use strong customer authentication

Authentication helps establish whether the person attempting a payment is authorized to use the card. 

Merchants can enable EMV 3-D Secure through their payment providers to support cardholder authentication. This allows transaction information to be shared with the card issuer, which evaluates the payment and determines whether additional authentication is necessary. 

Prevent account takeover

Card issuers should protect customer accounts using multi-factor authentication (MFA), particularly when suspicious activity occurs. 

For example, additional verification may be appropriate after an unfamiliar device login, password reset, payment method change or unusual purchase. These AML checks make it harder for criminals to exploit compromised accounts containing stored payment information.

Use Layered Transaction Controls  

Fraudsters may attempt numerous payments to test stolen card information. Merchants can limit this activity through checkout controls such as: 

• Rate limits on repeated transactions
• Bot detection and CAPTCHA 
• Restrictions on excessive card additions or payment attempts

Visa’s anti-enumeration guidance recommends these measures to help merchants identify automated card testing. 

Monitor transactions for suspicious activity 

Effective CNP fraud detection looks beyond individual payment details. Merchants can assess device activity, order history, delivery details, and available payment responses. However, merchants don’t have access to broader cardholder transaction details. 

Card issuers separately monitor account-level spending and authorization patterns. They can also evaluate card verification results and determine whether a payment should be approved or declined. 

For instance, a large purchase from an unfamiliar device immediately after several failed attempts may trigger additional verification. 

Review fraud alerts and improve the Rules 

Fraud patterns change, so prevention measures need regular assessment. Merchants should review suspicious orders, chargebacks, and checkout fraud patterns to improve their detection rules.

Card issuers can use confirmed fraud reports and transaction outcomes to refine their own authorization controls. 

Regular reviews can improve CNP fraud detection, reduce false positives, and maintain a smoother payment experience.