Card Not Present (CNP) transactions refers to accepting credit cards as payment when the credit card is not physically present. Learn the security and fraud risks associated with card not present (CNP) transactions, and how to minimize risks with CNP transactions.

What Is a Card Not Present (CNP) Transaction?

A card not present (CNP) transaction is a transaction made using a credit card that is not physically present at the point of purchase. It could be a mail order or a telephone order (these two are collectively referred to as MOTO) or an online sale. It stands in contrast to storefront merchants, who swipe physically present cards in POS (Point of Service terminals). Why is this an important distinction? Because card not present transactions open up possibilities for credit card fraud and because the responsible party is different in the two cases:

• In a transaction in which the credit card is physically present, swiped, and approved, if there is fraud, the bank that issues the credit card is liable for the amount charged.

• In a transaction in which the credit card is not physically present but the transaction is approved, if there is fraud, the merchant account bank is liable to return to the money.

What Are the Risks in a Card Not Present (CNP) Transaction?

There are two main risks in a card not present transaction. The first is a risk to the card holder and the merchant that a lost or stolen credit card or stolen card number is being used by someone who is not the person to whom the card was issued. The second is a risk to a card holder that his or her card is being used in a scheme involving phony merchant accounts.

What Are Some Strategies for Reducing Risk in Card Not Present (CNP) Transactions?

There are several steps that a merchant can take to reduce the risk in accepting credit card not present transactions:

• Do not authorize a transaction without receiving a valid expiration date. Lack of an expiration date or a valid expiration date is often a sign that the customer does not have the credit card present.

• Do not authorize a transaction without receiving a proper card security verification number. This is the 3- or 4-digit code on the front or back of the credit card, called the CVV2 by VISA, CVC2 by MasterCard, or CID by American Express and Discover.

• Use an address verification service, like AVS from Chase Paymentech's Suite of Risk Management Solutions, by verifying the billing address.

• Use one of the account ownership services, like Verified by VISA or MasterCard SecureCode during a transaction which not only helps cut down risk for the merchant, but also helps assure consumers of safe use of their card.

• Stay in compliance with all security standards, including PCI DSS, VISA's security program (CISP), MasterCard's data security program (SDP), etc.

• Be aware of some frequent tip-offs that a transaction may not be valid, including orders that are much larger than the customer's usual purchase; orders for multiples of expensive items; shipping outside the U.S.; an exaggerated number of charges to a single card in a short period or charges to a number of cards from a single address in a short period; or an email address that is provided for free to anyone and not, for example, linked to an ISP or another service.