Card-Not-Present Transaction
A card-not-present transaction is any card payment in which the card is not physically read by a terminal — online, in an app, by phone, by mail, or a stored-card charge — so the merchant cannot verify the chip, the PIN or the cardholder's presence. It carries higher interchange, higher fraud and a liability that rests with the merchant unless authentication shifts it; its controls are most of e-commerce payments engineering.
- Also known as
- CNP transaction, Card-absent transaction, Remote card payment
- Used at
- e-commerce, in-app purchases, subscriptions and recurring billing, telephone and mail order, invoicing with a card link, marketplaces; roughly a third of card volume in developed markets and the majority of card fraud
- Binding
- the schemes' rules distinguish CNP from card-present in interchange, in liability (the merchant bears fraud losses on CNP transactions unless authenticated), and in dispute rights; PSD2's SCA applies to electronic CNP payments in Europe
- Typical costs
- CNP interchange above card-present in most markets (in the US, 0.3–0.6 points higher on credit; in the EU, capped rates are the same but scheme fees differ); fraud rates several times card-present; chargeback rates likewise
- Typical controls
- 3-D Secure 2 with SCA exemptions, CVV and address verification, device fingerprinting and fraud scoring, velocity checks, network tokens for stored cards, and merchant-initiated-transaction flags for renewals
- Parties
- the merchant (which bears the fraud unless authenticated), its PSP and fraud vendors, the acquirer, the network, the issuer (which decides on authentication), and the cardholder who may not be who they say
How a card-not-present transaction works in practice
A customer types a card number, expiry and CVV into a checkout. The merchant's gateway sends an authorisation with what it knows — the numbers, the billing address, the device, the order — and, in Europe, a 3-D Secure request. The issuer approves or challenges; the merchant, if it took no authentication or claimed an exemption, bears the fraud if the card turns out to have been stolen. The transaction clears at the CNP interchange rate. Months later, if the cardholder disputes it as unrecognised, the chargeback lands on the merchant unless the authentication shifted liability — and the merchant's evidence is whatever it recorded: device, login, delivery.
The economics are the difference from a shop. A chip-and-PIN payment at a terminal proves the card and the cardholder; the issuer bears the fraud if it approves; interchange is lower. A CNP payment proves a string of digits; the merchant bears the fraud; interchange is higher; disputes are easier for the cardholder. So the industry built the CNP stack: authentication to shift liability, verification services to add signals, tokens to make stored credentials safe, fraud engines to score what the terminal would have seen. A merchant's CNP fraud rate, chargeback ratio and authentication metrics are its payments report card.
For a payments company, CNP is where the products are sold and the margins are made; for a buyer of an e-commerce business, the CNP loss lines are diligence.
Example
A retailer processes €40m of CNP volume with no authentication and a basic fraud rule set: fraud chargebacks 0.9% (€360,000, plus fees and goods), friendly-fraud chargebacks 0.4%, interchange at CNP rates. Its payments overhaul: 3-D Secure 2 on all first payments with exemptions on low-risk ones (liability shifted on 70% of volume), a fraud engine with device and velocity signals, network tokens for stored cards, merchant-initiated flags on repeat purchases. Year two: fraud chargebacks 0.15%, most on exempted transactions where the merchant kept liability by choice; friendly fraud represented under CE 3.0 with a 45% win rate; authentication abandonment 2%. The overhaul cost €180,000 and saved €500,000 in the first year; the chargeback ratio's fall also took the retailer off its acquirer's watch list.
Common mistakes
- Running CNP acceptance on card-present assumptions — no authentication, no fraud engine, a shop's chargeback expectations. - Skipping 3-D Secure to protect conversion and bearing every fraud loss as the price. - Storing cards as raw numbers instead of tokens. - Renewals sent through authentication with nobody present. - Reading a CNP business's payment costs at card-present interchange in a valuation model.