What is card-not-present fraud? A guide for card issuers

Card-not-present (CNP) fraud is any fraudulent payment made without the physical card: online, in an app, over the phone or by mail order. The impostor needs only the card details, not the card.

Why it dominates

Chip cards made counterfeit card fraud far harder in shops, so fraud moved to where the chip doesn't take part. The European Banking Authority and the European Central Bank reported in December 2025 that 83% of card fraud in Europe happens where the card isn't present. Globally, the Nilson Report put card fraud losses at $33.41 billion in 2024.

Where the details come from

• Data breaches at merchants and service providers.
• Phishing pages that imitate banks, delivery companies and shops.
• Skimming and malware that capture details at the point of entry.
• Social engineering, where the cardholder is persuaded to read their details out.

Controls issuers can use

• Authentication: 3D Secure confirms the cardholder for online payments that support it.
• Card controls: block manually keyed and phone-order payments where they are rare.
• Cardholder approval: when a payment can't be verified, ask the cardholder on their own phone before it goes through.
• Context: compare where and how the card is used with where the cardholder is.
• Shadow testing: measure any new control on live traffic before enforcing it.

Bring the cardholder into the decision

The cardholder is the one person who knows for certain whether a payment is theirs. The most effective CNP controls ask them, quickly and only when it matters, rather than guessing on their behalf. That is the idea 0Fraud is built around.