Card-not-present
Also known as: CNP
A remote transaction, online, phone, or mail, where the card isn't physically read.
A card-not-present (CNP) transaction is any payment where the card isn't physically present: e-commerce, phone (MOTO), and mail orders. CNP carries higher fraud risk and higher interchange, so fraud tools like AVS, CVV, and 3D Secure matter most here.
How it works
Plenty of merchants think of this as their website. It is broader than that. Deposits taken over the phone, emailed invoices, and repeat billing on a saved card are all card-not-present, even for a shop with a counter and a terminal. Anywhere the card itself is not read, you are in this category, paying its rates and carrying its risk.
The rate is only half of it. Card-not-present interchange is higher, and flat-rate processors publish a higher online rate to match. Liability is the bigger number: fraud losses on a remote sale fall on you by default, and each dispute carries a fee of roughly $15 to $25 that many processors keep even when you win the case. Running 3D Secure on risky orders is the main way to push that liability back to the issuer.
Card number, expiry date, and security code go in remotely, typed by the customer at checkout or by your staff in a virtual terminal. The gateway encrypts them and forwards them to the processor with the signals the issuer wants: billing address for the AVS check, the security code, device and IP data, any 3D Secure result. Back comes an approval or decline, plus separate match codes for the address and the security code. An approval is not a verdict on the order. The issuer can approve a sale and still flag an address mismatch, which most gateways let through unless you set a rule to hold or reject.
Worked example
An equipment dealer runs $40,000 a month in two channels. In store: $30,000 across 400 sales at 2.6% + $0.10, costing $820. Online: $10,000 across 120 sales at 2.9% + $0.30, costing $326. Shift $5,000 of counter volume to the website and the rate difference alone adds $15 a month, plus $0.20 on each of those sales. One $400 fraud chargeback would wipe out more than a year of that gap.
Frequently asked questions
- Why do card-not-present transactions cost more to process?
- The issuer cannot confirm the card was physically there, so the networks price that risk into interchange, publishing separate and higher categories for remote sales. Your processor then adds its markup on top. On published flat rates the gap is commonly around a quarter to half a percentage point, plus a higher fixed fee per transaction.
- Does an approved card-not-present transaction mean the payment is safe?
- No, and the two are barely related. Approval means the issuer found the card valid and the funds available, nothing more, and says nothing about whether the person typing the number owns it. Read the AVS and security-code responses that arrive alongside the approval. An address mismatch on a high-value or rush-delivery order is reason enough to hold it for review.
- Who pays for fraud on a card-not-present sale?
- You do, in almost every case. Without a chip read to prove the card was present, the merchant carries liability for fraudulent remote transactions, and the disputed amount plus a dispute fee comes back out of your account. The exception worth building for is a sale authenticated with 3D Secure, which shifts liability for that fraud type to the issuing bank.