Card-Not-Present Fraud: Why Online Payments Carry Different Risks

TL;DR: 5 Things to Know About CNP Fraud 

• Card-not-present fraud is the unauthorized use of payment credentials when the card is not physically presented. Visa’s Ecommerce Fraud Insights report states that most e-commerce fraud happens in CNP transactions, where no physical card is required.
• The FTC’s Consumer Sentinel Network Data Book 2024 logged more than 6.47 million Consumer Sentinel reports in 2024, including 2.6 million fraud reports and 1.1 million identity-theft reports, with credit-card misuse the top identity-theft category at 449,032 reports.
• The FBI’s 2025 IC3 Annual Report recorded $282.7 million in 2025 complaint losses under credit-card/check fraud, up from $199.9 million in 2024 and $173.6 million in 2023, proving the reported environment is getting heavier, not lighter.
• Mastercard’s Transaction Processing Rules show that an issuer can approve a payment even when AVS or CVC verification fails, so authorization alone is not proof that an order is legitimate. Because of this, Visa’s Merchant Dispute Management Guidelines indicate that blanket decline rules reject real buyers along with bad ones. 
• The PCI SSC’s E-Commerce Requirements podcast confirms that PCI DSS e-commerce requirements 6.4.3 and 11.6.1, covering payment-page script authorization and tamper monitoring, became effective on March 31, 2025, making checkout-page security part of fraud risk. 

 

The E-Commerce Fraud Gap: Why Online Payments Require Different Strategies 

If you take cards in person using secure physical POS products, you get signals a website never sees: a chip inserted, a phone tapped, a card you can look at. Move that same sale online, to a phone order, or to a payment link, and all of that disappears. You are left with data, and data can be stolen, replayed, or manufactured.

 

That gap is where most e-commerce payment fraud lives. It is also where many merchants make well-meaning mistakes, such as declining every order that fails an address check or assuming that an approved authorization means an order is safe to ship.

 

Through our tailored payment solutions, we have spent 15 years sitting between merchants and the payments system across Canada and the United States, in restaurants, retail, professional services, subscription businesses, and pure e-commerce. 

 

The pattern is consistent: the merchants who lose the least are not the ones with the strictest rules. They are the ones who understand what each control actually proves and who layer several imperfect signals rather than trusting a single one.

 

If you want to know how to prevent credit card fraud online, this guide breaks down four critical areas of CNP risk mitigation:  

• The Mechanics of CNP Fraud: How unauthorized credential use operates beyond the website checkout.
• Risk Profile Differences: Why online transactions carry distinct threats compared to in-person sales.
• Checkout Attack Tactics: What fraudsters specifically execute against digital payment forms.
• Practical Mitigation: Which controls reduce unnecessary exposure without driving away legitimate customers.

 

What Is Card-Not-Present Fraud, Exactly?

Card-not-present fraud is the unauthorized use of payment credentials in a transaction where the physical card is never presented to the merchant. That covers far more than a website checkout. 

 

The PCI SSC’s Glossary treats card-not-present as a channel that includes both e-commerce and mail-order/telephone-order acceptance, alongside card-present as the other main way merchants accept payment. 

 

That distinction matters because merchants often think of CNP as “our online store” and forget the rest. The following are all card-not-present transactions: 

• Emailed invoice links
• Virtual terminals for phone orders
• Automated subscription billing
• Social channel orders
• Cards keyed into the back office

 

Each one carries the same core problem: you cannot see the card, you cannot see the customer, and you cannot confirm the two belong together by looking. 

 

It also helps to separate CNP from fraud in general. Card not present is a channel, not a synonym for fraud. Most CNP transactions are perfectly normal purchases from real customers.

 

What changes is the evidence available to you. An in-person sale can capture proof that a card or wallet was physically presented through the terminal interaction. An online or phone sale has to work with digital signals instead: the payment credential itself, device and session information, the customer account’s history, delivery details, authentication results, and transaction patterns over time.

 

Those digital signals are genuinely useful. None of them is conclusive on its own. A matching address can be scraped from a data breach. A device can be spoofed. A brand-new account can belong to a first-time buyer or to a fraudster who created it ten minutes ago.

 

So the working definition for a merchant is practical rather than technical. Credit card fraud in a CNP environment occurs when someone who is not the cardholder can assemble enough seemingly correct data to pass your checkout. Your job is not to find one perfect test. It is to make assembling that data harder, and to notice when someone is trying.

 

Why Do Online Payments Carry More Fraud Risk Than In-Person Card Payments?

Online payments carry different fraud risks because the controls that protect in-person sales cannot be physically applied when no card is present. 

 

Visa’s Small Business Fraud Protection guidance directs merchants accepting cards face-to-face to use a magnetic-stripe reader, a chip-reading device, or a contactless terminal, and, where possible, to inspect the card’s physical security features. Visa separately advises card-absent merchants to take extra precautions, precisely because not all card security elements are available when the card cannot be seen. 

 

There is a second reason, and it is more interesting. The in-store defenses worked. NIST’s MFA for E-Commerce guide proves that smart chip cards and terminals protect in-store payments, and that these in-store security advances pushed actors holding stolen card data toward online payment-card fraud. Criminals did not stop; they moved to a channel where a stolen card number is still sufficient to attempt a purchase. 

 

Visa’s Ecommerce Fraud analysis concludes that the majority of e-commerce fraud occurs in CNP transactions, where the physical card is not required to complete the purchase. Visa attributes the extra opportunity to the absence of in-person verification and the potential use of stolen or synthetic credentials. 

 

Underneath it all lies an identity problem, not a card problem. The Federal Reserve’s Remote Authentication Fraud brief defines remote authentication fraud as occurring when someone who is not the legitimate owner of an identity or financial account creates or takes over a digital account to conduct illegal activity using stolen payment credentials or unauthorized payment information. 

 

Read that carefully: the fraud often starts at account creation or account takeover, well before the payment form. 

 

That reframes the question for merchants. Reducing the risk of payment fraud online is not only about screening the final payment. It is about knowing who is on the other end of the session and having a plan for when you are not sure. 

 

Merchants that accept both in-person and online payments must also stop treating their fraud numbers as a single pool. The channels behave differently, and blending them hides the problem. 

 

What Does the Broader Fraud Environment Actually Look Like?

The reported fraud environment is large, growing in some categories, and worth understanding as context rather than as a forecast of your own losses. The FTC’s Consumer Sentinel Network Data Book 2024 recorded more than 6.47 million reports to its Sentinel network, spanning fraud, identity theft, and other consumer issues. 

 

Break that total down, and the payments relevance becomes clearer. That same FTC data book and the FTC’s 2024 fraud losses release confirm:

• 2.6 million fraud reports.
• 1.1 million identity-theft reports.
• $12.5 billion in consumer fraud losses in 2024.
• 449,032 reports of credit-card misuse (ranking as the top identity-theft category).

 

Online shopping shows up prominently too. This FTC release identifies online shopping issues as the second most commonly reported category in 2024 fraud reports. 

 

For a merchant, that is a signal about more than payment screening. It points to billing clarity, delivery communication, and whether a confused customer reaches a human before they call their bank. 

 

The FBI’s numbers show a similar direction. The FBI’s 2025 IC3 Annual Report echoes this upward trend, recording $282.7 million in losses from credit card and check fraud in 2025, compared with $199.9 million in 2024 and $173.6 million in 2023. 

 

The same FBI report logged 56,478 non-payment/non-delivery complaints and roughly $503.4 million in reported losses in that category. Non-delivery is not necessarily credit card fraud, but it is a failure of customer trust that still leads to disputes.  

 

Now the honest caveat: plan well rather than panic. 

 

These are reported experiences, not a complete census of fraud, and none of them measures merchant CNP losses specifically. Do not use them to calculate your expected loss rate. Instead, use these figures to understand three realities: 

• The pressure from organized fraud rings is real and escalating.
• Credit card fraud represents the leading type of identity-theft complaint.
• Online shopping and delivery problems generate their own wave of consumer complaints alongside genuine payment fraud.

 

How Do Fraudsters Actually Attack a Digital Checkout?

Fraudsters attack digital commerce through several entry points, and the payment form is only one of them. Understanding the specific techniques is the difference between guessing at payment fraud prevention and targeting it.

 

• Credential stuffing. The OWASP Foundation’s Credential Stuffing overview defines it as the automated injection of stolen username-and-password pairs into website login forms to fraudulently gain access to accounts. It is not password guessing. It is replaying credentials already exposed in someone else’s breach, betting that your customers reused them. This OWASP overview notes that after a successful login, attackers make purchases or drain value from compromised accounts, access sensitive data, and resell the now-confirmed-valid credentials.  
• Account takeover. NIST’s MFA for E-Commerce guide explains that compromised e-commerce customer accounts are used for fraudulent purchases, gift card purchases and redemptions, and loyalty program misappropriation. This NIST guide also identifies what makes a site vulnerable: systems that allow repeated incorrect login attempts, customers who reuse passwords across systems, weak passwords, and password-reset options that are easy to bypass. 
• Carding and card cracking. These get confused constantly. The OWASP Automated Threat Handbook defines carding as multiple payment authorization attempts used to verify the validity of bulk stolen payment-card data. Card cracking is different: it involves identifying missing card details, such as expiration dates or security codes, by trying alternative values until one works. Both show up in your system as bursts of attempts rather than as one bad order. 
• E-skimming. The CISA E-Skimming awareness sheet explains that criminals introduce skimming code into e-commerce payment-card processing pages to capture payment-card and personally identifiable information, then send it to a domain they control. This CISA awareness sheet identifies three common entry points: exploiting a vulnerability in the e-commerce platform, obtaining network access through phishing or brute-forcing administrator credentials, and compromising third parties or supply chains by hiding malicious code in JavaScript that the site loads.  
• Everything else that is automated. The OWASP Foundation’s Bot Management and Anti-Automation Cheat Sheet lists credential stuffing, fake-account creation, gift-card enumeration, card testing, inventory hoarding, scraping, and fake reviews among the automated threats facing web applications. If your defenses only sit at the payment form, you leave the login, signup, gift-card balance, and API endpoints wide open. 

 

Why Is Checkout-Page Security Part of Payment Fraud Prevention?

Checkout-page security belongs in any payment fraud prevention conversation because a compromised payment page steals card data before your fraud rules ever run. No amount of transaction monitoring helps if the credentials are being copied as customers type them.

 

The mechanism is browser-side code. The PCI SSC’s Glossary defines payment-page scripts as programming-language commands or instructions on a payment page that a consumer’s browser processes or interprets, including scripts that interact with the page’s document object model. 

 

Every analytics tag, chat widget, personalization tool, and advertising pixel you load on a checkout page is code running in your customer’s browser, right next to their card number. 

 

That is why the standards moved. The PCI SSC’s E-Skimming guidance release explains that PCI DSS requirements 6.4.3 and 11.6.1 focus on three core defenses: 

• Ensuring that payment-page scripts are authorized.

• Checking the integrity of those scripts.

• Monitoring payment pages and security-impacting HTTP headers for unauthorized changes.

 

The PCI SSC’s E-Commerce Requirements podcast confirms that the future-dated PCI DSS v4.0.1 requirements, including those two e-commerce requirements, became effective on March 31, 2025. 

 

Here is the part merchants most often get wrong. Using a hosted or embedded payment form does not automatically hand off all responsibility. PCI SSC’s FAQ 1588 states that an e-commerce merchant using an embedded payment page or form, such as an iframe, must confirm that its site is not susceptible to script attacks that affect the e-commerce system. 

 

This PCI SSC FAQ states that a merchant satisfies this requirement by applying the relevant protections itself or by obtaining confirmation from its PCI DSS-compliant payment service provider that the solution includes such protections when implemented in accordance with the provider’s instructions. 

 

That same PCI SSC FAQ notes that the cited eligibility criterion does not apply to merchants whose sites redirect customers to a payment service provider, or who fully outsource payment functions such as sending a payment link to the provider’s site. Read that as a statement about the applicability of that specific criterion, not as a claim that redirected payment is risk-free. 

 

And do not self-diagnose your validation path. This PCI SSC documentation directs merchants to consult the compliance-accepting entity, typically an acquirer or payment brand, to determine whether an SAQ must be submitted and which one fits the environment. That is exactly the kind of question worth asking your broker before you assume. 

 

What Do AVS, CVV/CVC, and 3-D Secure Actually Verify?

Each verification tool answers a narrow question, and knowing which question is the whole skill. Treating any one of them as a fraud verdict is the most common mistake we see in CNP merchant accounts.

 

• AVS: Mastercard’s Transaction Processing Rules define the Address Verification Service as a process in which the issuer checks the address supplied for a CNP transaction. That is a verification signal about one data element. It is not identity proofing, and it does not confirm the buyer is the cardholder. 
• CVC/CVV: These Mastercard rules define a CVC 2/AVS check as issuer-side automated verification of the supplied card-validation code and address details for a CNP transaction. Read together, the code and the address are complementary signals. A stolen card number without the security code is harder to use, which is precisely why card cracking exists. 
• Authorization: This one deserves a warning label. Mastercard’s rules show that a payment can succeed after a CVC or AVS failure because issuers consider numerous signals when making authorization decisions. Approved does not mean verified. It certainly does not mean safe to ship without review. 
• 3-D Secure: EMVCo’s EMV 3-D Secure overview defines it as enabling the exchange of transaction, payment-method, and device information between merchant and issuer to authenticate the consumer and approve an e-commerce transaction. This EMVCo overview notes that many EMV 3DS transactions are approved immediately after the consumer clicks Buy, while issuers require additional authentication for higher-risk transactions, using methods such as one-time passcodes, knowledge-based questions, or biometrics. 
• Risk signals: NIST’s Special Publication 800-63 FAQ confirms that IP address, geolocation, time of day, transaction type, mouse movements, keystrokes, and deviations from normal usage are used in adaptive systems. This NIST FAQ classifies these as additional controls for digital authentication, not as authenticators themselves. 

 

Visa’s Merchant Dispute Management Guidelines pull it together by directing card-absent merchants to consider available tools such as Visa Secure, CVV2, and AVS, and request authorization for mail-order, telephone-order, internet, and recurring transactions. Layers, not a silver bullet. That is the answer to how to prevent credit card fraud in a CNP environment. 

 

How Do You Cut Fraud Without Declining Good Customers?

You reduce fraud risk without losing revenue by making friction proportional to risk, rather than applying maximum friction to everyone. Blanket rules feel safe and quietly cost money.

 

Visa’s Merchant Dispute Management Guidelines reinforce the point clearly: many legitimate payments have an incorrect postal code or CVC, and blanket rules that block every failed AVS or CVC check can block legitimate, issuer-authorized transactions. 

 

Think about your own customers. People move. They use a work address. They mistype a digit on a phone keypad. A rule that treats every mismatch as fraud declines a real buyer who has cash in hand. 

 

The alternative is risk-based decisioning. NIST’s MFA for E-Commerce guide demonstrates a model in which stronger authentication is triggered when risk thresholds are exceeded, rather than applied to every session. 

 

Applied to checkout, that means a returning customer shipping to a saved address they have used for two years moves through cleanly, while a first-time account placing a high-value order to a freight-forwarder address at 3 a.m. earns a second look. 

 

The OWASP Foundation’s Bot Management and Anti-Automation Cheat Sheet supports the same logic by mapping controls to the at-risk endpoint. Its examples include: 

• Login: Rate limits, breached-password checks, and MFA.
• Signup: Email or phone verification and velocity limits.
• Checkout and cart environments: Queues, purchase limits, and 3-D Secure.

 

Different doors, different locks. 

 

CAPTCHA deserves special mention because merchants overrely on it. The OWASP Foundation’s Credential Stuffing Prevention Cheat Sheet states that CAPTCHA and similar puzzles can identify and slow automated login attacks, but also notes that CAPTCHA is imperfect and can be easily defeated. This OWASP cheat sheet advises using it selectively for suspicious or high-risk login requests to reduce friction for everyone else.  

 

The practical framing we give merchants relies on three operational steps to build a middle lane: 

• Define the outcomes: Decide in advance what a “review” order looks like versus a “decline” order, because binary approve/decline choices guarantee expensive mistakes.

• Acknowledge the cost of friction: Accept that a review path costs a few minutes of staff time, whereas a false decline costs the entire sale and possibly the customer relationship.

• Document and tune: Record who staffs the review lane and the specific decisions made so you continuously refine the rules based on real results.

 

Partnering with a processor that offers comprehensive payment solutions ensures you have the data visibility required to tune these thresholds accurately. 

 

Fraud Prevention and Chargeback Prevention Overlap, But They Are Not the Same Job

Stopping fraud before fulfillment and reducing disputes after the sale are related disciplines with different tools. Merchants who conflate them end up over-investing in screening while leaving obvious dispute triggers in place.

 

Start with what actually causes a CNP fraud dispute. Visa’s Merchant Dispute Management Guidelines state that a card-absent fraud dispute is caused by the fraudulent use of a payment credential, the theft of the cardholder’s payment credential, or an unclear or confusing merchant name that leads the cardholder to believe the transaction is fraudulent. That third cause is not fraud at all. It is a customer who does not recognize a line on a statement. 

 

That single fact should send merchants to check their billing descriptor today. If a legal entity name appears on statements but customers know the business by a storefront or brand name, that mismatch manufactures disputes. 

 

The fix costs nothing: a recognizable descriptor, an order confirmation that arrives fast, support contact details the customer can actually find, and realistic delivery communication. 

 

Recall that the FBI’s 2025 IC3 Annual Report logged 56,478 non-payment/non-delivery complaints. Confusion about whether something shipped turns into a dispute regardless of whether a criminal was ever involved.  

 

Then there is dispute evidence. This Visa dispute guide identifies the following digital signals as relevant to compelling evidence: 

• Device ID and device fingerprint
• IP address
• Customer account or login ID
• Delivery address
• Merchandise or service descriptions
• Dates goods or services were provided

 

Those are the same digital signals collected for fraud screening, which is why organized, privacy-appropriate record retention pays off twice. These Visa guidelines also direct merchants responding to that CNP fraud condition to advise their processor if the transaction was Visa Secure-authenticated at authorization. Relevant evidence, not an automatic win. 

 

One more thing that surprises merchants who adopt 3-D Secure. The Verified by Visa Acquirer and Merchant Implementation Guide mandates that merchants maintain their existing e-commerce risk-management functions during and after implementation, including an understanding of fraud and chargeback risks and procedures for tracking fraud allegations and losses. Authentication is an addition to a fraud program, not a replacement for it.

 

How Do You Spot Payment Fraud in Your Business Before It Compounds?

You spot payment fraud in your business by monitoring patterns across endpoints and over time, not by inspecting individual orders in isolation. A single suspicious order is noise. A cluster is an attack.

 

Merchants must watch for specific signs of a fraudulent transaction pattern, as attackers validate large volumes of stolen data (carding) or iterate on expiration dates and security codes (card cracking): 

• Authorization spikes: A sudden spike in small-value authorization attempts indicates automated credential testing.
• High decline ratios: A high ratio of declines to approvals in a short window signals an active attack.
• Sequential testing: Repeated attempts on sequential card numbers reveal algorithmic number generation.
• Clustered orders: Many orders sharing a single device or shipping destination suggest a coordinated effort.
• High-risk fulfillment: Rush shipping on high-value goods to a new account bypasses standard manual review times.
• Location mismatches: Discrepancies between the billing region and IP geolocation may indicate device spoofing. 

 

Velocity rules catch these, but only if they are built correctly. The OWASP Foundation’s Bot Management and Anti-Automation Cheat Sheet proves that an IP-only approach fails when attackers distribute attempts across many usernames. 

 

In practice, that means monitoring combinations: account, device, IP or network, payment instrument, shipping destination, order amount, and time interval, tuned to how the business actually sells. A ticketing business and a wholesale supplier should not run the same thresholds. 

 

Measurement closes the loop. The OWASP Foundation’s Credential Stuffing Prevention Cheat Sheet advises generating metrics on detected and mitigated attack volume and enabling filtering by fields such as IP address, which helps identify defense failures, unidentified attacks, and the impact of new or improved defenses. If a business cannot say whether its rules caught more or fewer attacks this month than last, it is not running a fraud program. It is running a setting. 

 

Separate reporting by channel too. Card-present and card-not-present fraud, disputes, approval behavior, and refund patterns should be reviewed independently. A blended number can appear stable even as an e-commerce channel deteriorates.

 

This is also the moment to involve people outside the merchant’s own team. When a fraud pattern emerges, or funding or disputes start behaving strangely, a proactive processor relationship matters more than a dashboard alert. 

 

That is the work we do at Digitech Payments: acting as a white-glove liaison so merchants receive a human explanation of what is happening across payment operations, chargebacks, fraud concerns, and funding questions. Payment fraud prevention works best when merchant, processor, acquirer, security providers, and the fulfillment team are aligned and talking.

 

Comparing CNP Fraud Controls: What Each One Is Good For

No single control fully covers your card-not-present fraud risk, which is why comparing them side by side is more useful than ranking them. Each approach solves a different problem and fails in a different way. 

 

AVS and CVV/CVC validate elements tied to the credential. EMV 3-D Secure authenticates the person. Transaction monitoring reads patterns. 

Account security controls protect the login process before a payment is ever attempted. Payment-page script controls defend the data at the moment it is entered. Dispute-readiness records do nothing to prevent fraud but decide how well a merchant can respond afterward.

 

Look at the limitation column with as much attention as the strength column. That is where merchants get caught: assuming that an authorization is a verdict, that an iframe absolves the website of responsibility, or that 3-D Secure ends the risk-management job. 

 

Also note that outcomes, liability treatment, and customer experience for authentication depend on network, issuer, transaction type, geography, and configuration, so nothing here should be read as a guarantee.

Approach	Primary purpose	Signals or mechanics	Main strength	Important limitation
AVS + CVV/CVC checks	Validate elements tied to the credential	Billing-address data and card verification code	Low-friction foundational signals for CNP orders	An issuer can authorize even where AVS/CVC fails; blanket declines reject legitimate customers
EMV 3-D Secure	Authenticate the consumer via merchant-issuer data exchange	Transaction, payment method, device data; possible issuer challenge	Adds authentication and supports frictionless or challenged flows	Outcome and liability treatment depend on network, issuer, transaction, and configuration
Fraud scoring / transaction monitoring	Identify suspicious orders before fulfillment	Device, location, velocity, behavior, account, fulfillment signals	Focuses manual review and stronger controls on riskier orders	Adaptive signals are not standalone authentication; rules need tuning and measurement
Account-security controls	Reduce account takeover before checkout	MFA, breached-password checks, login rate limits, secure recovery, bot controls	Protects saved cards, loyalty balances, and account history	Does not replace payment-page security or transaction review
Payment-page script controls	Reduce payment-data theft at checkout	Script authorization, integrity validation, inventory, tamper detection	Addresses e-skimming and malicious browser-side code	Hosted or embedded options do not automatically remove website-security responsibility
Dispute-readiness records	Support investigation and response after a dispute	Authentication outcome, delivery details, device/session records, order records	Enables faster internal investigation and stronger representment documentation	Evidence requirements are program-specific; records cannot validate an invalid transaction

 

A 12-Step Card-Not-Present Fraud Risk Review

Work through this in order to strengthen your payment fraud prevention. It is deliberately operational, and none of it requires buying anything before starting.

• Map every remote payment channel in use: website checkout, mobile app, subscription billing, invoice links, phone orders, mail orders, marketplace sales, social commerce links, and the virtual terminal. Merchants routinely forget two or three of these, and forgotten channels go unmonitored.

• Split card-present and CNP data in reporting: Review fraud, disputes, approval behavior, and refund patterns by channel rather than as one blended figure. A healthy in-store number masks a deteriorating e-commerce number for months before anyone notices.

• Inventory every checkout and account endpoint: Include login, password reset, signup, cart, gift-card balance lookup, the payment form, APIs, and order-confirmation workflows. OWASP’s threat list makes clear that automated abuse targets all of these, not only the payment page.

• Write down the fraud scenarios that actually apply to the business: Cover stolen-card checkout fraud, carding, card cracking, account takeover, gift-card abuse, first-party misuse, non-delivery allegations, and e-skimming. A digital-goods seller and a furniture retailer face genuinely different mixes.

• Review payment-page architecture honestly: Determine whether the business uses a redirect, a hosted page, an embedded iframe, a direct API integration, or a combination of these across different channels. Script risk cannot be assessed until each channel’s model is known.

• Confirm PCI DSS validation responsibilities with the entity that receives them: PCI SSC’s FAQ 1588 advises consulting the compliance-accepting organization, typically an acquirer or payment brand, on whether an SAQ is required and which one applies. Do not assume the integration settles the question.

• Build a living inventory of scripts and third parties on payment pages: Capture analytics, tag managers, chat widgets, personalization tools, fraud tools, and advertising scripts. Every entry is browser-side code that runs alongside card data, and CISA’s e-skimming sheet identifies supply-chain JavaScript as an e-skimming entry point.

• Apply payment-page safeguards suited to the architecture, including script authorization, integrity protections, and mechanisms to detect unauthorized changes, in line with the PCI DSS e-commerce requirements effective March 31, 2025. Where a provider supplies these, get written confirmation.

• Layer transaction controls rather than trusting a single result: Combine authorization outcome, AVS, CVV/CVC, 3-D Secure availability and configuration, device and session signals, velocity patterns, and delivery risk. Any single match or mismatch should inform the decision, never decide it alone. 

• Harden customer accounts, especially those storing card data or loyalty value: Use password controls, breached-password checks, login rate limiting, secure account recovery, bot protections, and risk-based MFA. NIST’s e-commerce guide flags repeated login attempts and easily bypassed resets as specific weaknesses.

• Create a documented review path for high-risk orders: Define who reviews, what is verified, which fulfillment holds exist, and how the decision is recorded. Without a middle lane between approve and decline, good revenue is lost to caution.

• Measure, retune, and escalate early: Track detected fraud, prevented fraud, manual-review volume, false positives, disputes, refunds, account takeovers, and card-testing attempts. Re-review rules after launches, new geographies, promotions, or checkout redesigns, and raise material spikes with the processor immediately rather than waiting for a monthly report.

 

The Bottom Line: Where to Go Next 

Card-not-present fraud is not a problem a business finishes. It is a channel risk to manage, tune, and revisit every time the business changes. The merchants who handle it well are the ones who understand what each control proves, who keep clean records by channel, and who pick up the phone early when something looks wrong.

 

That last part is where a payment partner earns their keep. When fraud spikes, when disputes cluster, or when funding questions arise, merchants should be able to reach someone who explains what is actually happening rather than just pointing to a dashboard. Across 15 years, more than 1,000 reviews, and a 4.4 out of 5 rating, that proactive, human support is the standard we hold ourselves to at Digitech Payments, backed by the track record of the Digitech group.

 

To take action on your payment operations, keep these three operational next steps in mind: 

• Simple, Transparent Pricing: Work with transparent terms customized and negotiated based on your specific volume and transaction type.
• Customized Quotes: Reach out directly to your broker for numbers tailored to your transaction mix and business scale.
• Expert Compliance Alignment: Confirm details touching PCI DSS applicability, SAQ eligibility, network liability rules, or dispute representment requirements with your acquirer, qualified security assessor, and compliance advisors.

 

Reach us through Digitech Payments when a second set of eyes on CNP risk would help.

 

Frequently Asked Questions

1. How to protect my business from card fraud when the card is never present?

Start by layering controls rather than relying on a single check. Visa’s fraud guidance directs card-absent merchants to consider available tools such as Visa Secure, CVV2, and AVS, and to request authorization for mail-order, telephone-order, internet, and recurring transactions. Add account-security controls at login, script controls on the payment page, and a documented manual-review path for high-risk orders. Then measure results by channel to tell whether the controls work or simply add friction. 

 

2. How to spot payment fraud in my business before losses add up?

Spot payment fraud by watching patterns across endpoints rather than judging orders one at a time. Look for spikes in low-value authorization attempts, unusually high decline rates, repeated use of a single device or shipping address, and mismatches between the billing region and IP geolocation. OWASP’s credential stuffing guide demands generating metrics on detected and mitigated attack volume to identify defense failures and unidentified attacks. Review card-present and card-not-present data separately, as a blended report can hide a deteriorating channel. 

 

3. What are the signs of a fraudulent transaction on an e-commerce site?

Signs of a fraudulent transaction include a brand-new account placing a high-value order, rush shipping to an address that does not match the billing address, several orders from different cards on the same device, and repeated failed attempts followed by a successful order. Be careful with single data points, though: Industry guidance from Visa and Mastercard proves that many legitimate payments have an incorrect postal code or CVC, so a mismatch alone is not proof. Treat these as reasons to review an order, not automatic reasons to decline it. 

 

4. What is a card testing attack, and how is it different from card cracking?

A card testing attack, which OWASP’s threat handbook classifies as carding, involves multiple payment authorization attempts to verify the validity of a bulk set of stolen payment card data. The attacker is not trying to buy anything; the attempts check which stolen numbers still work. Card cracking is related but distinct: it involves identifying missing card details, such as expiration dates or security codes, by testing alternative values. Both appear as bursts of attempts, which is why velocity controls tuned across account, device, and card dimensions matter. 

 

5. How to reduce fraud on phone orders and other MO/TO transactions?

Reduce fraud on phone orders by treating them as the card-not-present transactions they are. PCI SSC’s glossary places mail-order and telephone-order acceptance within card-not-present, alongside e-commerce, so the same layered logic applies. Request authorization for MO/TO transactions per Visa’s dispute guidelines; collect and verify address and security code details; apply velocity monitoring across phone and web orders; and establish a documented hold-and-verify process for high-value or unusual requests before anything ships. 

 

Works Cited

• Cybersecurity and Infrastructure Security Agency (CISA). E-Skimming. CISA, 2020.
• EMVCo. EMV 3-D Secure. EMVCo, n.d.
• Federal Reserve Payments Improvement. Remote Authentication Fraud. Federal Reserve, n.d.
• Federal Trade Commission (FTC). New FTC Data Show Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024. FTC, 2025.
• Federal Trade Commission (FTC). Consumer Sentinel Network Data Book 2024. FTC, 2024.
• FBI Internet Crime Complaint Center. 2025 IC3 Annual Report. FBI, 2025.
• Mastercard. Transaction Processing Rules. Mastercard, 2025.
• National Institute of Standards and Technology (NIST). NIST Special Publication 800-63 FAQ. NIST, 2022.
• National Institute of Standards and Technology (NIST). Multifactor Authentication for E-Commerce, Volume B. NIST, 2019.
• OWASP Foundation. OWASP Automated Threat Handbook. OWASP, 2015.
• OWASP Foundation. Bot Management and Anti-Automation Cheat Sheet. OWASP, n.d.-a.
• OWASP Foundation. Credential Stuffing. OWASP, n.d.-b.
• OWASP Foundation. Credential Stuffing Prevention Cheat Sheet. OWASP, n.d.-c.
• PCI Security Standards Council (PCI SSC). Coffee with the Council Podcast: Guidance for PCI DSS E-Commerce Requirements Effective After 31 March 2025. PCI SSC, 2025a.
• PCI Security Standards Council (PCI SSC). FAQ 1588. PCI SSC, 2025b.
• PCI Security Standards Council (PCI SSC). New Information Supplement: Payment Page Security and Preventing E-Skimming. PCI SSC, 2025c.
• PCI Security Standards Council (PCI SSC). Glossary. PCI SSC, n.d.
• Visa. Ecommerce Fraud. Visa, 2025.
• Visa. Merchant Dispute Management Guidelines. Visa, 2024.
• Visa. Verified by Visa Acquirer and Merchant Implementation Guide. Visa, 2011.
• Visa. Small Business Fraud Protection. Visa, n.d.