Card-not-present (CNP) fraud
What is card-not-present (CNP) fraud?
Card-not-present (CNP) fraud occurs when a fraudster makes a payment without physically using the victim’s payment card. This typically happens in online, phone, or mail-order transactions, where the merchant cannot verify the card in person. Cybercriminals often exploit stolen card data, account credentials, or social engineering techniques to authorize transactions.
CNP fraud is a growing concern as e-commerce and digital payments continue to rise, and it remains one of the most persistent threats for financial institutions, merchants, and consumers.Because CNP transactions take place remotely, customer authentication helps financial institutions verify that the person attempting to access an account or make a payment is legitimate.
Passwordless methods such as FIDO authentication us public-key cryptography to help protect payment and account-access journeys from phishing and credential theft.
How does CNP fraud work?
Fraudsters use a combination of methods to execute CNP attacks:
- Stolen card data: Purchased on the dark web or obtained through phishing, data breaches, or skimming.
- Account takeover (ATO): Fraudsters can use stolen login credentials to make purchases or change account details - an example of account takeover fraud.
- Social engineering: Fraudsters may use social engineering fraud to trick victims into revealing card numbers, verification codes, or other information needed to authorize payment.
- Automated fraud tools: Bots can test card numbers in bulk to find valid combinations for online purchases.
Once the fraudster has the necessary information, they can complete online purchases, request refunds to new accounts, or sell digital goods, often leaving merchants and cardholders responsible for the loss.
Why is CNP fraud a concern for financial institutions and merchants?
CNP fraud bypasses traditional physical card security, like EMV chips, making it harder to detect. This results in:
- Increased chargebacks and financial losses.
- Erosion of customer trust and loyalty.
- Greater operational costs for fraud detection and remediation.
- Difficulty distinguishing legitimate transactions from fraud without sophisticated tools.
As digital transactions grow, CNP fraud remains one of the most persistent threats for financial institutions and merchants. Below are practical, industry-proven strategies that help reduce risk while keeping the customer experience smooth.
- Strengthen customer authentication: Use strong, multi-factor authentication and apply intelligent step-ups only when risk signals require it.
- Use device and behavioral intelligence: Use device identity to recognize and bind trusted devices, while monitoring behavioral patterns to detect unusual or suspicious activity.Where additional verification is needed, cognitive biometrics can provide another authentication signal based on unique mental processes, such as memory recall or problem-solving patterns.
- Apply real-time transaction risk scoring: Analyze signals like device fingerprinting, IP velocity, and geolocation to approve, step up, or block transactions.
- Adopt dynamic security features: Replace static CVV with dynamic or one-time card security codes to prevent misuse of stolen credentials.
- Optimize merchant controls: Encourage tokenization, enforce AVS/CVV checks, and strengthen verification for high-risk merchant categories.
- Improve customer communication: Provide warnings for unusual activity, share scam-avoidance tips, and offer simple in-app controls.
- Monitor fraud end-to-end: Use continuous fraud monitoring across channels to connect signals and act early on compromised credentials.
Additional resources:
- Solutions: Stop increasingly complex scams from crippling your organization.
- Video: Financial Institutions and Fraud: Learning from the Market
- Blog: 5 Ways fraud prevention can reduce call center operational costs
- Blog: The Top 3 Fraud Tactics That Lead to Account Takeovers
- Blog: How to Stop App Fraud: Protect Your Business from Digital Threats
Keywords:
CNP fraud | CVV | 3D Secure
