CNP (Card Not Present) fraud

Fraud committed on a purchase where the merchant never physically sees the card, most online and phone transactions.

When a shopper types card details into a website or reads them over the phone, nobody can inspect the card, a chip, or a signature, so a thief with the numbers can pretend to be the cardholder.

Fraudulent use of card credentials in a transaction where the merchant cannot physically inspect the card, encompassing stolen-card fraud, account takeover, package rerouting, and friendly fraud.

Card-not-present fraud takes several forms:

• Stolen card details, used to buy goods or services online.
• Account takeover, in which a criminal logs in to a customer's account and uses saved payment methods.
• Package rerouting, in which a criminal changes a delivery address so the goods go elsewhere.
• Friendly fraud, in which a genuine cardholder disputes a purchase they made.

Merchants use several checks to defend against it:

1. Card verification code and address checks, which compare the printed security code and the billing address with the issuer's records.
2. 3-D Secure, which asks the cardholder to confirm the purchase and can shift fraud liability to the issuer.
3. Device, network, and behavior signals, which show whether the buyer looks like a real customer.
4. Velocity checks, which catch a burst of attempts from one source.

Card-not-present fraud sits next to terms that are easy to mix up:

• Card-present fraud happens in person with a physical card, where a chip and PIN add protection.
• Account takeover (ATO) is one route to card-not-present fraud, when attackers use a hijacked account.
• 3-D Secure is an authentication step designed to reduce it.

For more, see Payment Fraud: What is It & How to Prevent it?.