Most high-risk commerce is card-not-present, so mastering CNP fraud controls and clear descriptors is central to keeping an account healthy.
Card-not-present fraud happens when someone uses stolen card details to buy without the physical card. Because the merchant cannot inspect the card or the buyer, the merchant usually carries the loss when a CNP sale turns out to be fraud, unless an authentication step such as 3-D Secure shifts liability to the issuer.
Layered checks are the standard defense: CVV and address verification at checkout, 3-D Secure for riskier orders, velocity checks that flag repeated attempts, and review of orders that don't fit a customer's normal pattern.
Common questions
- What is card-not-present fraud?
- Card-not-present (CNP) fraud is a purchase made with stolen card details online, by phone or in an app, where the card is never physically shown. It is the most common type of card fraud for ecommerce merchants.
- Who is liable for card-not-present fraud?
- In most cases the merchant carries the chargeback when a card-not-present sale proves fraudulent. Authenticating the buyer with 3-D Secure can shift that liability to the card issuer for covered transactions.
- How do merchants prevent card-not-present fraud?
- Use several checks together: require CVV, verify the billing address, apply 3-D Secure to higher-risk orders, set velocity rules that catch repeated attempts, and review orders that look unusual before shipping.