With the increasing popularity of eCommerce and mobile shopping, card-not-present (CNP) transactions are widely used by consumers today. However, this form of payment—as convenient as it is—does not come without its risks.
Industry reports show that card-not-present fraud continues to rise as eCommerce grows, making it one of the most common forms of payment fraud. Merchants, therefore, should know how to accept CNP payments most effectively without incurring losses or driving up costs.
Here’s everything you need to know about CNP transactions, including what they are and how they work.
Key Takeaways
- A card-not-present (CNP) transaction is when a payment is made without the card being physically presented to the merchant, such as online, phone, or invoice payments.
- CNP transactions are riskier and more prone to fraud than CP transactions. Consequently, the processing rates for CNP transactions are typically higher due to the security risks involved.
- The liability for CP fraud lies largely with the issuing bank. In contrast, for CNP fraud, the burden lies on the merchant—yet another reason why interchange rates on CNP transactions are typically higher.
- Because of their riskier nature, CNP merchants must adhere to strict compliance requirements, including PCI DSS, and implement authentication protocols such as encryption and tokenization.
What Is a Card-Not-Present (CNP) Transaction?
A card-not-present (CNP) transaction is a payment transaction where a physical payment card is not presented to the merchant at the time of purchase. The transaction is handled on the backend the same way as traditional credit card processing, but the payment is completed remotely—such as online, over the phone, or via invoice, by entering card details or using stored payment credentials.
Examples of CNP Transactions
Some common examples of card-not-present transactions include:
- eCommerce. When a customer places an order on a website or an online store and pays for it by entering their card information online.
- Mail order. When a customer fills out a form, enters their payment information, and mails it to the business to place the order.
- Phone order. When a customer places an order over the phone and shares their payment information with the store associate.
- Subscription or recurring payments. When a customer signs up for a subscription or membership (e.g., gym membership, magazine subscription), they provide their billing information to be stored in the merchant’s system. Thereafter, automatic payments are deducted at previously agreed-upon intervals.
- Invoices. When a customer pays for an invoice using their previously stored billing details or a payment link from the merchant.
Card-Present vs Card-Not-Present Transactions
The main difference between card-present (CP) and card-not-present (CNP) transactions is that in CP transactions, a physical payment card (or a digital wallet on a smartphone or other mobile device) is present to the merchant and interacts with a payment terminal via swipe, tap, or dip.
However, in a CNP transaction, no physical card is presented to the merchant. Since card information is entered remotely, CNP transactions are riskier and more prone to fraud than CP transactions. Consequently, the processing rates for CNP transactions are typically higher than those for CP transactions due to the greater security risks involved.
| Feature | Card-Present (CP) Transactions | Card-Not-Present (CNP) Transactions |
| Definition | The card or payment credential is physically presented and read by a payment terminal. | The payment credentials are provided remotely and are not physically read by the merchant’s payment terminal. |
| How payment is made | Swipe (magstripe), dip (EMV chip), or tap (NFC/contactless). | Card details are entered manually online, over the phone, or via invoice/payment link. |
| Common environments | Retail stores, restaurants, in-person events, and pop-ups. | eCommerce websites, phone orders, recurring billing, and mail orders. |
| Authentication method | EMV chip validation, contactless tokenization, sometimes PIN or signature. | CVV, AVS (address verification), 3D Secure, and tokenization. |
| Fraud risk level | Lower fraud risk due to physical card interaction and chip security. | Higher fraud risk because the card is not physically verified. |
How Much Do CNP Transactions Cost?
According to official card network fee schedules, there isn’t a single published “card-not-present (CNP) cost.” Still, the underlying interchange fees set by Visa and Mastercard show that CNP transactions typically carry higher interchange fees than card-present transactions due to increased fraud risk and the lack of chip verification.
For example, Visa’s published interchange reimbursement fee schedule includes distinct rates for CNP transactions (often above 2% of the transaction value plus a fixed amount) that acquirers pay to the issuing bank, which form the baseline cost merchants indirectly incur when accepting online or keyed-in payments.
The Hidden Fraud Risk Behind CNP Transactions
The risk of fraud in CNP transactions is much higher than in CP transactions because they do not require the physical card to complete the payment. CNP fraud occurs when a fraudster gains access to a cardholder’s payment information, such as their card number, expiry date, CVV/CVC, etc., and uses it to make unauthorized purchases. Fraudsters may obtain such access through data breaches, phishing attacks, malware, and other unscrupulous means.
If a fraudster somehow gains access to a cardholder’s credentials and uses them to make a purchase, the cardholder can file a dispute with their bank.
In such cases, not only does the merchant lose the value of the sale, but also ends up providing a free product or service to the fraudster. In addition, they may incur chargeback fees for a customer’s dispute. If a merchant receives a high number of chargeback requests, they may be eligible to pay additional fees to their payment processor.
Compliance Requirements for CNP Merchants
Because of their riskier nature, CNP merchants must adhere to the following compliance requirements:
- PCI Compliance. Any merchant who processes, stores, or transmits card data must comply with the Payment Card Industry Data Security Standard (PCI DSS). As part of this, they may need to complete an annual Self-Assessment Questionnaire (SAQ) and an Attestation of Compliance (AOC). In addition, they should not store any sensitive data after authorization, such as CVV/CVC codes.
- AVS. Merchants should use an address verification service (AVS) to verify whether the customer-entered billing address matches the one registered with the issuing bank.
- CVV/CVC. Merchants should also verify card security codes during CNP transactions to confirm that the user actually possesses the card.
- 3D Secure. It is highly recommended that merchants processing CNP transactions implement 3D Secure authentication to add an additional layer of identity verification.
- Encryption and tokenization. Merchants must ensure that all payment data is encrypted before transmission, and sensitive data should be replaced with unique “tokens” when stored.
How to Accept CNP Payments in Your Business
To accept card-not-present payments, merchants typically need a payment gateway or processor that can handle remote transactions. These systems allow businesses to collect card details through online checkout pages, virtual terminals, invoicing tools, or recurring billing platforms. Once a gateway or payment platform is set up, merchants can accept CNP payments through several channels while implementing security measures such as AVS checks, CVV verification, encryption, and tokenization to help reduce fraud risk.
Online
- To accept CNP payments online, merchants need to set up a payment gateway and integrate it with their website or eCommerce platform. The gateway provides a secure checkout page where customers can enter their payment details and complete a purchase.
- To reduce fraud risk, capture key billing information such as card number, expiration date, billing address, and CVV during checkout. Address Verification Service (AVS) checks can help confirm that the customer-entered billing address matches the one on file with the issuing bank. There is a greater likelihood that a person who isn’t the legitimate cardholder will not have access to all the details. This can help weed out fraudulent transactions to an extent.
Over-the-Phone
- To accept CNP payments over-the-phone, merchants typically use a virtual terminal provided by their payment processor or gateway. A virtual terminal allows staff to manually enter a customer’s card details into a secure interface while speaking with them.
- For security, merchants should follow PCI DSS guidelines when handling card information, verify billing details such as address and CVV, and use secure systems to prevent the improper storage of card data.
Subscription & Recurring Billing
- To accept recurring CNP payments, merchants need a subscription billing platform or a recurring billing feature within their payment gateway. Customers provide their payment details once, and the system automatically charges the card at scheduled intervals.
- To protect customer data, merchants should rely on tokenization and encrypted storage through their payment provider, rather than storing raw card numbers themselves. Additional verification measures, such as AVS checks and CVV authentication, can help confirm the cardholder’s identity when the payment method is first added.
Payment Links & Invoicing
- Merchants can accept CNP payments by sending digital invoices or payment links through their payment gateway or invoicing software. These links direct customers to a secure payment page where they can enter their card details and complete the transaction.
- For security, merchants should ensure that payment pages use an encrypted connection and that invoices or payment links are sent only through trusted channels, such as email or SMS. Capturing billing details and using verification tools such as AVS can help confirm the payer’s identity.
Future Trends in CNP Payments
Card-not-present payments are evolving quickly as payment networks and technology providers introduce new tools to reduce fraud and improve authorization rates. Here are some of the trends and developments to watch:
Network tokenization. This replaces raw card numbers with secure tokens issued by card networks. These tokens reduce the impact of data breaches and help improve approval rates for recurring or stored-credential transactions.
AI-based risk scoring. Modern payment systems can analyze hundreds of signals in real time, including device data, transaction patterns, purchase history, and behavioral indicators. These systems analyze hundreds of signals in real time, including device data, transaction patterns, and behavioral indicators, to assess fraud risk before a transaction is authorized.
Biometric verification. This includes fingerprint or facial recognition through digital wallets and banking apps. Such solutions add another layer of identity confirmation without creating friction for customers.
Intelligent payment routing. These systems automatically send transactions through the most optimal processor or network path to help increase approval rates while lowering processing costs.
Together, these innovations aim to make CNP payments more secure and efficient, helping merchants reduce fraud risk while maintaining a smooth checkout experience for customers.
How Kurv Helps with CNP Payment Processing
With Kurv, accepting CNP payments is easier than ever. Whether you accept CNP transactions online, over the phone, by mail, or via invoicing or recurring payments, Kurv gives you complete peace of mind with its secure suite of payment processing solutions and built-in authentication and fraud-prevention controls. To learn more, contact us today.
Ready to Grow Your Business?
Apply and start accepting payments within a day
Frequently Asked Questions
Are all online payments card-not-present?
Most online payments are classified as card-not-present (CNP) transactions because the card is not physically presented to the merchant at checkout. This includes eCommerce, invoices, and keyed transactions, even if added security tools are applied.
Why are CNP processing fees higher?
CNP fees are higher due to increased fraud risk. Without chip verification or face-to-face interaction, there is no way to verify that the customer is really the customer, so banks charge higher prices for these transactions because there is greater chargeback exposure.
Is a digital wallet transaction card-not-present?
In-store wallet taps are card-present. Online wallet payments are CNP, though typically lower risk.
How can merchants lower CNP fees?
Use AVS, CVV, 3D Secure, tokenization, accurate data submission, and maintain low chargebacks to improve pricing.
What evidence is required to dispute a CNP chargeback?
Merchants typically need proof of authorization, transaction details, billing information, delivery confirmation, and customer communications.
