Merchant Fraud Guide Sections

Card Not Present Fraud Prevention

CNP fraud is the biggest online fraud problem. Here is a set of habits, in layers, that a small merchant can run at checkout.

Every online order is a card not present transaction. Nobody hands you plastic. You see numbers on a screen, and you have to decide whether to ship. That is why card not present fraud dominates online fraud, and why prevention is a set of habits rather than one tool. This page is the playbook, layer by layer.

What card not present fraud is

A fraudulent transaction is a payment that is not authorized by the actual cardholder. Thieves use stolen credit card details, or other tricks, to buy things the cardholder never agreed to. When that happens on your store, you lose the goods, you lose the sale, and a fraudulent sale can later turn into a chargeback. Fraud can also hurt your store's money and its good name.

Why it is harder to stop online

In person, you can inspect the card and the buyer. Online, there is no physical card to inspect. The numbers are all you get. Visa's data shows CNP fraud rates are 7.5 times higher than card-present transactions, and CNP fraud accounts for nearly 89% of all payment fraud. The rest of this page is what you do about it.

Layer 1: Collect the right data at checkout

Collect the CVC, postal code, and billing address for every payment. The CVC is the three- or four-digit number printed directly on a card. It exists so you can ask for something a thief who only has the card number might not have. Two limits matter. Businesses can't store the CVC number, so it works only at the moment of checkout. CVC checks do not stop a stolen physical card. A stolen card has its CVC printed right on it.

Layer 2: Verify the billing address with AVS

The Address Verification System checks one thing. Does the billing address given match the cardholder's address on file? It gives you a way to check if the shopper placing the order is the same person as the cardholder. AVS is a widely used fraud check for card not present sales. That means online payments and Mail Order/Telephone Order payments. It works with Visa, Mastercard, Discover and American Express cards. Most cards from the United States, Canada and the United Kingdom support street address checks.

Read the result with care. AVS checks can fail for legitimate payments. A failed CVC or postal code check can indicate the payment is fraudulent. Can, not does. When you ship physical goods, check whether shipping and billing addresses match. A match is one good sign. A mismatch is one question, not a verdict. If you want to go deeper on reading the signal, see card not present fraud detection.

Layer 3: Authenticate the customer with 3-D Secure

EMV 3DS is a fraud prevention protocol for online sales. It checks that the shopper is real. It does this without making checkout harder than it needs to be. For higher-risk sales, the card issuer may ask for more proof. That could be a one-time passcode, security questions or a fingerprint or face scan. EMV 3DS also supports Strong Customer Authentication. It does this with two-factor authentication.

The payoff is large. Visa's data says authenticated eCommerce transactions show approximately a 45% reduction in fraud compared with non-authenticated ones. There is a rule called liability shift. Payments checked with 3D Secure might be protected from most fraudulent disputes under it. Turn it on at checkout where your processor offers it.

Layer 4: Watch for fraud indicators before fulfilling

No single sign convicts an order. Several fraud signs on one order can mean the payment is fraud. The ones worth watching:

  • Likely false information, like fake phone numbers and email addresses
  • Customer details that do not match across past purchases
  • Unusually large orders
  • Requests to split a large order across multiple cards
  • Many cards using the same shipping address
  • Requests to refund outside the card network
  • Overnight or expedited shipping requests, which are worth treating as higher risk

One flag is a reason to look. You can also read about account takeover fraud.

Layer 5: Review and decide on high-risk orders

Automated systems can decide most payments for you. But human judgment can make the call more accurate. You are the best judge of whether a payment might be fraud. You know your products, your prices and your customers. Think about delaying the shipment. Do this for high-value orders, addresses you have not verified, or first-time customers. It buys you time to look again before the box leaves. Shipping to a verified billing address that passed postal code and street address checks is the safest option. If you use ai fraud detection, let it sort the queue, then apply your own judgment to what it flags.

What prevention can and cannot do

These habits can help prevent disputes and fraud, but they cannot eliminate them completely. The goal is to catch most of the bad orders while keeping checkout easy for the good ones. Run the layers, review what they surface, and write down how you decide, so you decide the same way next time.

Sources

The rest of Fraud prevention