Everything You Need to Know About Card-Not-Present Fraud

Credit and debit cards are vital for online purchases in today’s digital environments, but that doesn’t mean they’re safe from misuse. In 2024, an estimated $10.6 billion was lost due to card-not-present fraud, which accounts for some of the most prevalent scams globally. Card-not-present fraud, or ‘CNP’ fraud, negatively impacts consumers and businesses, causing financial losses and reputational damages. CNP fraud can happen to anyone, and learning about its signs, variations, and preventions can help minimize and mitigate many of its consequences.

What is Card-Not-Present Fraud?

Card-not-present transactions occur when a consumer makes a purchase or transaction without needing a physical card. These transactions mostly happen over the phone or via online platforms. They are possible because the cardholder can provide the required information to complete the trade, most often including the cardholder’s name, card number, expiration date, and security code. 

What is card not present fraud? CNP fraud happens when an unauthorized user takes the information on a consumer’s card and uses those details to make transactions. Card-not-present fraud most commonly occurs related to e-commerce platforms, over-the-phone orders, and subscription membership services; more specifically, the non-presence of the card at the time of these transactions is the element that differentiates this form of fraud from others. Fraudsters only need a few details to complete their goals, usually only the card owner’s name and the card number itself.  

Fraudsters who choose to take over consumer accounts are part of growing trends. Nearly a quarter of US adults reported being victimized by account takeover fraud in 2023, and such rates are expected to grow further in the coming years. How consumers face these growing threats will determine their susceptibility to fraudsters of all types, not just those looking to misuse their debit and credit cards. 

Types of Card-Not-Present Transactions

Here are the most common cases when you can fall prey to this type of fraud:

Online Purchases

Many online platforms do not require a physical card to make purchases; as long as the card is attached to a valid bank account, most merchants will accept requested transactions. E-commerce platforms are high-value targets for CNP fraud because they collect and save consumer card details and because merchant websites are not as secure as physical stores (despite being more convenient). 

Phone or Mail Orders

Other times, consumers can make transactions without a card over the phone, as with app purchases, or through the mail, as with catalogs. These transactions usually don’t require verifying that the buyer has a physical card, which makes them highly susceptible to fraud. Moreover, these types of purchases can range from consumer interest to business products, putting more than just the card owner at risk for additional losses. 

Subscription Services

Subscriptions are among the most common types of card-not-present purchases because it is assumed that the cardholder is reading the agreement they accept for services. However, if the consumer doesn’t pay attention to what they agree to, they could find themselves paying for numerous memberships; this is perfect for fraudsters, as they can get away with charging a consumer’s account for long periods without detection.

Mobile Payments or Digital Wallets

Card-not-present transactions are also common when consumers use their phones to purchase goods via mobile payment and digital wallet options. Mobile payment platforms like Apple Pay and Google Pay save card details that fraudsters can exploit, while digital wallets can save various payment options that can be stolen with the device. Even worse, if the stolen device doesn’t have proper security, fraudsters can expose their victim’s entire life.

How Does Card-Not-Present Fraud Work?

Here’s how fraudsters try to get your funds. 

Methods Fraudsters Use to Obtain Card Information

Malicious characters have a wide variety of options to obtain card information. As mentioned above, they can purchase complete consumer profiles on the dark web, but the more advanced threats tend to do the work themselves. For example, some fraudsters rely on devices like skimmers. Skimming devices can steal card information, but they must get physically close to the card for the scheme to work. Fraudsters often collect the details they want from recent data breaches or successful phishing emails. 

How Stolen Card Information is Used

After obtaining the consumer details that their transaction needs, scammers can immediately start draining their victim’s accounts. These purchases are usually online transactions but can also include mail or mobile activities. Then, when the fraudster finishes making their purchases or transactions, they can either leave the empty card alone—hoping that the consumer doesn’t notice the purchases or lock the card—and wait for some time before committing more fraud, or they can close the victim’s accounts—canceling the card in the process—and make off with their bounty.

Real-World Examples

In 2023, the cybersecurity world was shaken by the zero-day vulnerabilities of MOVEit, a file transfer program used by thousands of companies globally. The data breaches that occurred due to the MOVEit vulnerabilities are still being discovered today; consequently, it could be years before consumers stop feeling the repercussions—if they ever stop. 

Let’s say a patient was staying in a hospital hit by a data breach due to the MOVEit vulnerability, as was the case with millions last year. If their card payment information was saved in their hospital records, and the attackers copied these details, they could turn around and sell it or use it whenever they saw fit. This might include The only way the patient could stop this misuse would be to cancel their cards preemptively. 

However, fraudsters have more options than attacking hospitals with traditionally low cyber security. Scammers could offer time-sensitive deals that entice victims into clicking their ads, simultaneously (1) stealing any saved payment information from the victim’s browser and (2) downloading tracking malware to their device. There are many ways a fraudster could collect the information they need—that’s what makes holistic cyber security a necessity. 

What are the Consequences of Card-Not-Present Fraud?

A card-not-present fraud benefits fraudsters only; for other parties of the process, including consumers and businesses, this scam possesses certain risks. 

For Consumers

Card-not-present fraud has nasty effects on consumers. Not only do they tend to lose immediate funds directly to the scammers, but they can also suffer long-term impacts. If they seek restitution, the resulting legal process can force further costs and stress on the victim; even worse, the victim can be continuously victimized in the following years, especially if the fraudster can steal their identity. 

For Businesses

Companies also struggle after falling victim to card-not-present fraud. Consumers may request chargebacks to their accounts, stripping the company of the entire product cost, plus some fees. Companies may lose funds and reputation following a CNP event, as consumers may not trust them again. They can also have further financial losses associated with increased fraud prevention tools and investigation processes. 

How To Detect Card-Not-Present Fraud

• Suspicious activity within a bank account is the most apparent sign that something is wrong. Consumers should review their purchase histories monthly, double-checking any transactions that indicate “CNP” or “credit card not present during this transaction.”
• CNP fraud can also be detected if the cardholder receives notifications for purchases they didn’t or don’t remember making; this is why staying on top of subscription and membership trials is critical, as consumers are more likely to ignore the notifications of smaller purchases. 
• Sometimes, consumers can also detect card-not-present fraud if they start receiving packages or services for which they never made a transaction; in cases like this, the fraudsters are likely already in control of the consumer’s account and are making moves to further defraud a target company or vendor.

How To Protect Against Card-Not-Present Fraud

Be aware! Specific actions and security measures can help you detect early signs of fraudulent activity and possibly protect yourself from it. 

Tips for Consumers

For all the dangers of CNP fraud, there are simple preventative steps that consumers can use to protect themselves. Arguably, the most critical consumer protection is to use strong passwords; the stronger and more complex passwords, the more challenging it is for scammers to break. At the same time, if consumers enable multi-factor authentications (MFAs) and embrace regular account monitoring schedules, they can further defend their accounts from malicious troublemakers. 

Best Practices for Businesses

Companies can also benefit from taking preventative measures. Implementing fraud detection systems is a great way to monitor their cloud environments, while using Address Verification Systems (AVS) can help catch threats before they find sensitive data. Moreover, companies can implement customer-facing tools to help protect themselves and their clients from fraudsters, such as utilizing CVV codes when making CNP purchases and using two-factor authentication for account changes and access.

What To Do If You’re a Victim of Card-Not-Present Fraud

• Report the fraudulent activity to your financial provider. They may not have known the account had any issues, which could prompt them to review their systems.
• Monitor all the accounts associated with the exposed card information. If the scammers have enough details, they may be able to access other accounts linked with the compromised data.
• File a police report if necessary. Not all situations require a police report, but if the victim wants further action, a police report is the best way to start the retribution process. 
• Freeze your credit if the exposed data includes such information. This will help deter fraudsters from using the details, as frozen credit will prevent further transactions from being completed. 

Card-not-present fraud is a constant threat. It victimizes consumers and can lead to companies crumbling under the weight of financial and reputational losses. CNP fraud works by a scammer obtaining a consumer’s card details and using that information to make online purchases and transactions. 

Many signs, such as suspicious purchases in their histories, can alert consumers that something is wrong with their accounts. However, the best way to deal with card-not-present fraud is to take preventative measures rather than retroactive ones to avoid losing card information. If consumers stay vigilant and companies take steps to protect themselves and their clients, fraudsters may be out of luck.