In 2024, card payments within the EEA made without strong customer authentication (SCA) had twice the fraud rate of payments made with it (EBA and ECB, December 2025, p. 25). Remote card payments exempted from SCA generally ran above the 0.033 percent rate for all cards, which "could suggest that fraudsters adapt their attacks" (p. 31).
What is card not present fraud?
Under credit card fraud in what fraud is, it is the kind that needs only card data. UK Finance reports it as remote purchase fraud, when "a criminal uses stolen card details to buy something on the internet, over the phone or via mail order" (Annual Fraud Report 2026, p. 25).
In the US, CNP fraud accounted for 54.3 percent of 2023 debit card fraud losses at issuers with $10 billion or more in assets (Federal Reserve, p. 19). The credit card fraud entry covers the card present side too.
What counts as a card not present transaction?
Any card payment where the merchant never sees the card. The Federal Reserve's CNP category covers internet, telephone and mail order payments (p. 11). Visa adds some in app payments and handles the fraud disputes under condition 10.4, card absent environment (Visa Dispute Management Guide for Merchants, October 2026, p. 22). CNP in banking means the same thing.
How does a card not present fraud attack unfold, and who can stop each stage?
Table 1. The four stages of a card not present attack, and who can stop each one.
| Stage | What the fraudster does | What the merchant or issuer sees | Who can stop it |
|---|---|---|---|
| 1. Theft | Takes card data through a breach, phishing or malware | Nothing yet | The breached company, through PCI DSS controls |
| 2. Checking | Tests which numbers are live, often in bulk | A burst of authorization attempts, many declined | The issuer and the acquirer, with velocity rules |
| 3. Spending | Orders goods or services at a remote checkout | A new device, address or email on the order | The merchant's checks and 3-D Secure |
| 4. Dispute | Has moved on; the cardholder spots the charge | A fraud dispute under Visa condition 10.4 | The merchant, with delivery and purchase history evidence |
The stages can sit months apart: breach data "can be used for months or even years after the incident" (UK Finance, p. 28). When the dispute arrives, the merchant's strongest answers are proof of delivery or a purchase pattern linked to the cardholder (Visa, p. 23).
What are the most common methods behind card not present scams?
Visa's dispute guide names three ways card details get compromised (p. 22):
- Phishing. Fake messages and sites collect card details; the same lure leads to account takeover.
- Malware. Two Romanian nationals were convicted in April 2019 over a malware scheme to steal card data for dark market sales (USAO N.D. Ohio).
- Data breaches. Vitalii Antonenko and fellow conspirators took card numbers, expiration dates and verification values through SQL injection and sold them online (USAO D. Mass., December 2024). UK Finance calls data compromise at retailers and other firms "a major driver" of UK online card fraud losses (p. 28).
UK Finance also counts the fake social media shop that keeps the buyer's money and pays a real seller with a stolen card (p. 25). Skimming, which copies a magnetic stripe at a cash machine for a fake card used with the PIN, is card present fraud (p. 29).
What is card testing, and how do banks spot it?
Card testing is running stolen numbers through payment checks to see which still work. The EBA and ECB link part of remote card fraud to "testing large volumes of card numbers" (p. 21). Try2Check, a card checking service taken offline on 3 May 2023, ran at least 16 million checks over nine months of 2018 on a major US payment processor's systems, the indictment alleges (USAO E.D.N.Y.). Paying attention to these test procedures means watching for bursts of attempts on one merchant or device.
Which signals point to card not present fraud?
Unusual behavior only shows against data the merchant holds, so collecting customer information at checkout comes first.
- Address or card code mismatches. Visa lists unreviewed mismatches among the situations behind card absent fraud disputes (p. 22).
- No 3-D Secure. Visa also lists payments processed without additional authentication (p. 22).
- Declines before an approval. The testing stage, seen from the checkout.
- Account details changed just before an order. A sign of a taken over account.
How do merchants and issuers detect and prevent card not present fraud?
In spring 2022, Roderico Allen tried dozens of online handgun orders with stolen credit card information. Fraud prevention systems stopped some. At least six sales still went through (USAO S.D. Ohio, 20 August 2024). Merchants and issuers stack these layers:
- Know Your Customer (KYC). Issuers and acquirers verify the account holder or merchant with Know Your Customer checks.
- Address and card code checks. The typed details are matched against the issuer's records.
- Velocity rules and transaction monitoring. Rules count attempts per card, device and IP address; transaction monitoring compares each payment with the customer's history.
- Payment Card Industry (PCI) Data Security Standards. PCI DSS sets "a baseline of technical and operational requirements designed to protect payment account data" (PCI SSC).
A mitigation framework adds threat intelligence about breaches to these layers, so the issuer knows which card numbers to watch.
Does 3-D Secure stop card not present fraud?
It lowers the fraud rate but does not stop it: UK Finance reports SCA and one time passcodes "being bypassed by criminals through social engineering" (p. 15). 3-D Secure adds cardholder authentication, confirmed by the issuer, to an online card payment (Visa, p. 97). UK and EU law require SCA on an electronic remote payment to link it to a specific amount and payee (Payment Services Regulations 2017, regulation 100; PSD2, Article 97). A fully authenticated EMV 3-D Secure payment (ECI 5) can qualify a Visa merchant for protection from fraud disputes (p. 97).
From Ufuk Gürdaş, reviewer of this entry: "3-D Secure moves who pays, not whether the fraud happens: UK Finance reports criminals talking cardholders into giving up one time passcodes so a fraudulent online payment passes authentication, and the EBA and ECB note that an authenticated payment cannot automatically be treated as authorized."
Which laws cover card not present fraud in the US, UK and EU?
Table 2. Card not present fraud by jurisdiction: the offense, and who carries the loss on an unauthorized remote payment.
| Jurisdiction | Offense and maximum | Who carries the loss when authentication is skipped |
|---|---|---|
| US, credit cards | 18 U.S.C. 1029: an account number is an access device; knowingly using unauthorized ones with intent to defraud to obtain $1,000 or more in a year carries up to 10 years, a fine or both | Regulation Z, 12 CFR 1026.12(b) caps the cardholder's share and does not mention authentication; Visa's dispute rules decide whether 3-D Secure protects the merchant (ECI 5, above) |
| US, debit cards | The same offense | Regulation E, 12 CFR 1005.6(b) ties a consumer's cap to how fast the loss is reported and does not mention authentication; Visa's rules as above |
| UK (the Fraud Act offense: England, Wales and Northern Ireland) | Fraud Act 2006, s2: a representation can be made to "any system or device"; up to 10 years, a fine or both on indictment (s1(3)) | PSRs 2017, reg 77 (UK wide): unless the payer acted fraudulently, nothing for the payer where the card paid for a distance contract other than an excepted one, such as gambling (77(4)(d)) or where regulation 100 required SCA and the payer's provider did not apply it (77(4)(c)); a payee that does not accept that SCA compensates the payer's provider (77(6)) |
| EU (the 2019/713 offense: not Denmark or Ireland, recitals 38 and 39) | Directive (EU) 2019/713, Articles 3 and 9: fraudulent use of a stolen or unlawfully obtained payment instrument, with a national maximum of at least two years | PSD2, Article 74(2): unless the payer acted fraudulently, nothing for the payer where its provider did not require SCA; a payee or its provider that fails to accept SCA refunds the payer's provider |
Criminal law punishes the fraudster. Payment law decides who refunds the cardholder, and in the UK and EU the side that skipped SCA carries the loss. Regulation 77 of the Payment Services Regulations 2017 also clears the payer for most distance contracts, consumer sales concluded at a distance (Consumer Contracts Regulations 2013, reg 5). The Fraud Act's offense sections cover England, Wales and Northern Ireland.
Why does card not present fraud also concern the AML team?
The issuer's fraud team scores each authorization and handles the cardholder's claim. The merchant's risk team decides which orders to stop, authenticate or ship. AML starts when the proceeds move. Antonenko and others laundered the card data sale proceeds through Bitcoin, bank and cash transactions.
At complead, formerly Sanction Scanner, payment fraud decisions at authorization and transaction monitoring over days and weeks run on the same customer record, so each customer keeps one risk score. Its payment fraud detection reads small value probes, repeated declines in one BIN range and one device trying many cards as a single card testing campaign.
Card not present vs card present fraud: what changes?
Table 3. Card not present and card present fraud compared (EEA 2024; US debit card issuers with $10 billion or more in assets, 2023).
| Card not present | Card present | |
|---|---|---|
| What is checked | Typed details, address, card code, 3-D Secure | The physical card and, for chip cards, the PIN |
| Largest fraud type | Card details theft, over 56% of EEA remote card fraud value (EBA and ECB, p. 21) | Lost or stolen cards, 42% of EEA non remote card fraud value (p. 21) |
| US debit fraud transactions as a share of all purchase transactions, 2023 | 0.061% (Federal Reserve, p. 36) | Counterfeit 0.021%; lost and stolen 0.018% (p. 36) |
| Largest share of US debit fraud losses, 2023 | Merchants, 65.1% of CNP losses (p. 23) | Issuers, 49.3% of lost and stolen losses (p. 23) |
At large US issuers in 2023, CNP fraud made up 0.061 percent of all debit purchase transactions, about three times the counterfeit share.
This week:
- Sort last month's declined authorizations by merchant and device, and look for bursts.
- List the remote orders that skipped 3-D Secure, with the reason for each.
- Check who carried your last ten CNP losses against Table 2.
Related terms
- Chargeback fraud. The cardholder made the purchase and disputes it anyway.
- E-commerce fraud. Fraud aimed at online stores and their buyers.
- Synthetic identity fraud. Credit obtained for a person who does not exist.
