Card-Not-Present Fraud

Overview

Meaning and boundaries

Card-Not-Present Fraud is unauthorized use of payment-card credentials in a transaction where the physical card is not read or presented to the merchant, such as online, mobile, mail, or telephone commerce. This fraud involves unauthorized card use when the physical card is not read by the merchant, typically in web or phone commerce. The payment processor cannot rely on a physical chip interaction, so fraud controls draw on account history, device signals, authentication, velocity, and issuer decisions.

How it works in practice

High-risk changes or instructions should be verified through a trusted independent channel, and controls should not rely on information supplied inside the potentially compromised message or session. In this context, controls may include tokenization, strong customer authentication, address and security-code checks where appropriate, device and behavior analysis, velocity limits, risk scoring, and post-transaction dispute monitoring. Records should preserve the original request, account and device events, approvals, beneficiary changes, transaction identifiers, communications, authentication results, review notes, and recovery actions. Teams should connect related attempts without exposing unnecessary personal or credential data. Useful measures include attempted and confirmed loss, prevented value, false-positive rate, review time, recovery rate, beneficiary-change exceptions, customer complaints, repeat attacks, and control-bypass findings. The relationship with Payment Risk Rule should be documented where it affects residual risk or control ownership.

Checks and failure points

Balance prevention with legitimate customer access. Excessive declines increase abandonment, while weak account and transaction controls expose businesses to chargebacks and losses. Record the evidence behind risk decisions and protect sensitive card data.

How it differs from related terms

Card-not-present fraud belongs to card payment rails with issuer and chargeback mechanisms; crypto transfer scams and wrong-address payments work differently. Related entries: Card-Present Fraud; Checkout Fraud; Payment Risk Rule.