Card-not-present transactions: costs, fraud, and liability

A card-not-present transaction is a card payment where your terminal never reads the card. Visa's definition of a card-absent environment covers sales completed without a valid card or cardholder present, and it names the usual suspects: mail order, telephone order, and internet sales. If a customer types card details into your website, reads them over the phone, mails in an order form, or gets billed on a card you keep on file, that's card-not-present (CNP).

If you sell online or take phone orders, CNP is part of your business, and it plays by different rules than a tap at the counter. They cost more in interchange, they attract more fraud, and when fraud happens the loss usually lands on you. This guide covers all three, plus the tools that shift the odds back: AVS, CVV2, 3-D Secure, and better evidence for chargebacks. Rates and rules are as of October 2026.

What counts as a card-not-present transaction?

The test is simple: was the card read by your terminal (chip, tap, or swipe) with the cardholder there? If not, treat the sale as card-not-present.

Keyed entry is the gray zone. When the card and cardholder are standing at your counter but you type the number in, Visa still treats it as card-present, and its dispute condition for that case (10.3, Other Fraud, Card-Present Environment) lists the usual causes: the card wasn't swiped or chip-read, no manual imprint was taken, or a card-absent sale wasn't properly flagged as an internet or mail and phone order. Visa warns that even an authorized, signed key-entered sale can come back to you if fraud occurs and the receipt lacks an imprint.

So a plumber in Charlotte who takes deposits over the phone should key them as mail and phone orders in a virtual terminal, not punch them into the countertop unit as if the customer were there.

Why do card-not-present transactions cost more?

Interchange, the fee the card issuer earns on each sale, is higher for CNP. You can see it in the networks' own tables. These are Visa consumer credit rates from the Visa USA Interchange Reimbursement Fees schedule dated April 18, 2026, comparing its main card-present and card-not-present programs.

Mastercard's 2026 to 2027 US rate schedule, effective April 17, 2026, shows the same pattern. For its Core consumer credit card, the Small Ticket Card Present rate is 1.65% + $0.02 while Small Ticket Card-Not-Present is 1.95% + $0.02, and its Key-entered program sits at 1.95% + $0.10. Mastercard says each rate has requirements, and that they include factors such as the presence or absence of magnetic stripe data and the time between authorization and clearing.

Here is what that gap does to a real month. Say an online shop in Austin runs $40,000 a month on Visa cards in the "all other products" group, at an $80 average ticket, so 500 sales.

• At the card-present rate: 1.51% of $40,000 is $604, plus 500 × $0.10 = $50, for $654 in interchange.
• At the card-not-present rate: 1.89% of $40,000 is $756, plus the same $50, for $806.
• The difference: $152 a month, or $1,824 a year, before your processor's markup.

Real card mixes vary, so treat that as an illustration, not a quote. The lesson is that CNP volume costs more no matter who processes it. On interchange-plus pricing, you see those rates passed through line by line; our comparison of interchange-plus and flat-rate pricing explains why that visibility matters when much of your volume is online.

Why is card-not-present fraud higher?

Part of the answer is that chip cards made in-person fraud harder. When the Federal Reserve measured card fraud by channel, in-person card fraud fell from $3.7 billion in 2015 to $2.9 billion in 2016 while remote card fraud grew from $3.4 billion to $4.6 billion, a shift that coincided with a sharp rise in chip card use. By 2016, 61.1% of fraudulent card payments by value were remote. Keep the scale in mind, too: the same Fed release found card fraud was under one-tenth of a percent of all card payments.

The mechanics explain the shift. A chip or tap generates a one-time security code for each transaction that can't be reused, which helps prevent counterfeit fraud at the terminal. Online, there's no chip in the conversation. The card number, expiration date, and security code are the same every time they're typed, so stolen details can be reused.

Disputes follow the same pattern. Visa's merchant guide says card-absent merchants may experience higher disputes than card-present merchants because the card isn't read electronically, which increases liability for disputes.

Who is liable for fraud on a card-not-present transaction?

By default, you are. The US chip liability shift that took effect October 1, 2015 was built for counterfeit card-present point-of-sale transactions, so it does nothing for online or phone sales. When a cardholder says they didn't make a CNP purchase, the issuer can file a fraud dispute (Visa calls it 10.4, Other Fraud, Card-Absent Environment), and your acquirer debits the amount from your account.

3-D Secure is the main way to move that liability. It adds an authentication step with the card issuer during checkout, and EMVCo describes EMV 3-D Secure as a tool to help issuers and merchants prevent CNP fraud. Visa's version is Visa Secure, and its rules are spelled out in the same dispute guide:

• The cardholder is successfully authenticated (ECI 5): you're protected from fraud-related disputes.
• The issuer or cardholder doesn't participate (ECI 6): you're still protected from fraud-related disputes.
• You don't participate or don't attempt authentication (ECI 7): no protection.

Confirm the details with your acquirer before you count on them. Mastercard's Identity Check program guide states that merchants only receive the liability shift for transactions submitted for authentication that receive a valid authentication value.

Two limits are worth knowing. First, the protection covers fraud-related disputes; a "never arrived" or "not as described" claim is a different fight. Second, authentication can add a step at checkout. Mastercard's guide recommends risk-based authentication, where the issuer reserves extra checks for riskier transactions, which is the version you want.

How do AVS and CVV2 protect card-not-present sales?

They're the two checks every CNP merchant should run, and they also give you dispute rights. The Address Verification Service (AVS) lets a card-absent merchant check the cardholder's billing address with the card issuer; a "Y" response means the street address and postal code match. CVV2 checks the three- or four-digit security code.

Visa's dispute guide spells out when those checks let your acquirer respond to a fraud dispute:

• You got an AVS "Y" match and the billing and shipping addresses are the same, and you can show proof of the shipping address plus signed proof of delivery.
• You verified AVS or CVV2 and the issuer answered "U", meaning it was unavailable or doesn't support the check, which Visa's merchant acceptance guide says gives you a representment right.
• On a mail, phone, or e-commerce sale, the CVV2 result was "N" (no match) with a presence indicator of 1, and the issuer approved the sale anyway.

Mastercard pushes the same tools on merchants with fraud problems. Its security rules require acquirers to act on merchants whose CNP fraud has exceeded 100 gross basis points, and for e-commerce that means capturing and sending the CVC 2 value or becoming Mastercard Identity Check enabled.

One rule pairs with all of this: collect the security code to authorize, then never keep it. Our guide to what PCI compliance is explains why storing it after authorization is off-limits. Clearo's online payments include fraud screening with AVS, CVV checks, and velocity rules that limit repeated attempts.

How do card-not-present chargebacks work, and how do you answer them?

A CNP fraud dispute starts the same way as any chargeback: the cardholder calls their bank, the issuer sends the transaction back, and your acquirer debits you and asks for a response. Visa's guide lists the most common causes of a 10.4 dispute: a fraudster used someone's card details, the cardholder's credentials were stolen, or an unclear merchant name made a real purchase look fraudulent.

That last one is often friendly fraud, and Visa's rules now give you a way to fight it. Under Compelling Evidence 3.0, effective April 2023, a 10.4 dispute becomes invalid when you show that the same cardholder made earlier undisputed purchases with matching data. Visa's acquirer FAQ requires at least two matching elements from customer login ID, delivery address, device ID or fingerprint, and IP address, and one of them has to be the device ID, device fingerprint, or IP address. The dispute guide adds that the prior transactions must have settled between 120 and 365 days before the dispute.

Mastercard's advice for CNP fraud claims is similar: the merchant can submit the IP address of the device used for the purchase. Neither works if you never saved the data, so log it at checkout. For the full dispute timeline, see how a chargeback works.

A card-not-present checklist for online, phone, and mail orders

1. Keep card data off your own systems: use hosted checkout online and key phone orders straight into a virtual terminal.
2. Run AVS and CVV2 on every CNP sale, and decide in advance which mismatches you'll decline.
3. Ask your processor whether 3-D Secure fits your higher-risk orders.
4. Save the login ID, IP address, device ID, and delivery address for every order.
5. Don't charge the card for a shipped order until it ships.
6. Get signed delivery confirmation on high-value orders sent to an AVS-matched address.
7. Make sure your billing descriptor shows a name customers will recognize.
8. Flag phone and mail orders as MOTO instead of keying them as card-present.
9. Review fraud and dispute counts monthly against the network thresholds in our guide to preventing chargebacks.

Item 5 comes straight from Visa: for card-absent sales, don't deposit the transaction with your acquirer until you've shipped the merchandise.

When is 3-D Secure not worth it?

Here's our honest take. 3-D Secure is worth turning on when fraud disputes are eating real money, when you sell easily resold goods, or when your fraud ratio is creeping toward network thresholds. It's less compelling if you sell low-ticket items to repeat customers with almost no fraud, because any added checkout step can cost sales you'll never see in a report.

Whatever you decide, do the free things first: AVS, CVV2, saved order data, clear descriptors, and shipping before charging. Those cost nothing per transaction and protect you in more dispute types than authentication does. Rules like these come from the card networks, so they apply the same way across the United States.

Next step

If a big share of your volume is online or by phone, it's worth checking how much you're paying for it. Send us a recent statement for a free statement review and we'll show you how your volume splits between card-present and card-not-present rates and where keyed sales could move to a terminal. Selling online mostly? Our ecommerce page covers setups for online stores, or contact us to talk through your fraud tools.