What is Card Not Present Fraud?
Card‑not‑present (CNP) fraud occurs when stolen card data is used for e-commerce (web or app), or
mail/phone orders—anywhere a physical chip cannot be read by the merchant. Armed with breached numbers, guessexpiries,
and farmed CVVs from testing, attackers purchase digital goods to resell, physical goods to ship to mules, or services
they can quickly monetize.
Why it’s hard: legitimate customers can fail AVS/CVV, proxies/emulators obscure the network’s “fingerprints,”
and 3DS step‑ups, if abused, can kill conversion. Context is king—correlate device, network, behavior, and
purchase patterns; elevate risk judiciously if the story doesn’t hold up.
Controls that play well together: demand CVV; normalize and score AVS; apply 3DS selectively; build device
graphs; score BIN/country corridors; throttle bursty micro‑auths that smell like testing. Monitor geovelocity, cart
composition, and prior dispute history by BIN and email domain. Pause or step‑up high‑risk orders (self‑gift cards,
resellable electronics, digital keys with instant use, etc.) until risk signals cool or the proof gets stronger.
For sensitive actions (credential edits, payout changes), bind users with strong identity verification and let your checkout stack do the heavy lifting (see payment fraud prevention) to keep approvals high and losses low.
TLDR: CNP fraud is pattern recognition under pressure. Layer signals, tune friction, and learn from every
dispute.
