Card-Not-Present Fraud: What It Is and How Merchants Reduce It

Card-not-present (CNP) fraud is the use of stolen card details to pay without the physical card: on a website, over the phone, by mail order or inside an app. With no chip or PIN, the merchant relies on the details entered, plus any authentication the card issuer adds. UK Finance reports these losses as remote purchase fraud.

What is card-not-present (CNP) fraud?

It is any payment made with stolen card details where the card is not physically presented. Fraudsters need the card number, expiry date and usually the security code, sometimes with the cardholder’s name and billing address. Chip and PIN makes stolen card data hard to use in shops, so the details are worth most where no card is needed.

What is a card-not-present transaction?

A card-not-present transaction is any card payment where the card is not read by the merchant’s terminal at the time of payment, so the details are typed, spoken, written down or charged from storage instead. Card schemes and acquirers treat these payments as their own category, with their own fraud rules and chargeback risk. Common examples:

The same wallet tapped on a shop terminal is a card-present transaction, because the terminal reads it directly. Card-present payments carry cryptographic proof from the chip or wallet that the genuine card or device was there; card-not-present payments rely on the details entered and whatever authentication the issuer adds.

How does card-not-present fraud happen?

Who pays for CNP fraud?

Usually the merchant. The cardholder reports the payment, the issuer refunds them and raises a chargeback through the card scheme, and the acquirer debits the merchant for the sale plus a chargeback fee.

The main exception is 3-D Secure: when a payment is authenticated, liability for fraud-related chargebacks generally shifts from the merchant to the issuer, subject to each card scheme’s rules.

How do 3-D Secure and Strong Customer Authentication reduce CNP fraud?

Strong Customer Authentication (SCA) requires two independent factors, from something the customer knows, has or is, for most online payments the customer initiates. In the UK the duty sits with payment service providers under regulation 100 of the Payment Services Regulations 2017, and the FCA’s enforcement date for e-commerce was 14 March 2022. For card payments, EMV 3-D Secure is how issuers apply SCA: the checkout passes the payment to the issuer, which approves it silently or challenges the cardholder, often in their banking app.

Some payments fall outside SCA or qualify for exemptions, such as mail and telephone orders, merchant-initiated payments like subscription renewals, and low-value or low-risk payments. Our PCI 3DS guide explains how 3-D Secure works and the separate PCI standard for companies running 3DS components. Sovereign Secure is a PCI SSC-listed 3DS Assessor for those companies, through our PCI 3DS assessments; merchants that simply use 3-D Secure do not need one.

Does PCI DSS prevent CNP fraud?

PCI DSS cannot stop a fraudster using card details stolen elsewhere at your checkout, but it stops your business being the source of those details. The PCI DSS v4.0.1 controls that matter most for online and phone merchants:

• 6.4.3 and 11.6.1: authorise and inventory every script on the payment page and detect unauthorised changes to it, both mandatory since 31 March 2025. SAQ A merchants instead confirm their site is not susceptible to script attacks, as our guide to payment page script rules explains.
• 6.4.2: an automated solution, such as a web application firewall, protecting public-facing web applications, also mandatory since 31 March 2025.
• 3.3.1.2: never keep the card security code after authorisation, including in call recordings and notes, a common gap when taking card payments over the phone.
• Tokenisation and outsourcing: tokenisation and provider-hosted payment pages keep card numbers out of your systems.
• 11.4: penetration testing where it applies, including web application testing of your checkout.

What is the difference between a chargeback and a breach?

How can Sovereign Secure help?

Sovereign Secure is a PCI SSC-approved Qualified Security Assessor (QSA) company, also a Qualified PIN Assessor, Card Production Security Assessor, P2PE Assessor and 3DS Assessor, and a GEAR member for 2026 to 2028. We do not sell fraud screening or run 3-D Secure; your payment provider does. We help online and phone merchants make sure their checkout is not where card data leaks, through PCI DSS assessments, SAQ support and testing. For a quick view of your own position, take our free PCI compliance check.

See our overview for retail and e-commerce businesses, or ask for a PCI DSS quote.