Card-Not-Present Fraud
Purchases and account funding made online with stolen card credentials, where the merchant usually carries the chargeback liability unless authentication shifts it.
What it is
CNP fraud is the monetization stage for stolen card data. The fraudster is not the cardholder, the cardholder did not authorize the transaction, and when they notice, they dispute it under a fraud reason code (Visa 10.4, Mastercard 4837). Unless the transaction was authenticated with liability shift, the merchant eats it.
Keep it distinct from:
- Card Testing: validates cards; small or zero value, usually upstream.
- Chargeback and Friendly Fraud: the real cardholder disputes a legitimate purchase. The dispute codes are the same even though what happened is different, and misclassifying friendly fraud as CNP fraud corrupts your labels.
- Account Takeover (ATO): when the stolen credential is a login to an account with a stored card, the payment looks "owned" and card-level signals won't save you.
- Triangulation Fraud: a seller uses stolen cards to fulfill real buyers' orders.
How it works
The fraudster acquires card credentials (breach, phishing, skimming, malware), validates them, and chooses a merchant whose goods or value can be converted to cash quickly. They transact while blending in, then receive and convert the value. Later the cardholder disputes and the merchant absorbs the loss.
CNP fraud exploits a timing mismatch. Authorization is instant, but the fraud label (the chargeback) arrives weeks to months later, after the value is gone.
Transaction footprint
| Stage | What you see in the data | Decision point |
|---|---|---|
| Pre-purchase | New or guest account; card added recently; billing/shipping/IP/device inconsistencies; prior failed card attempts | Account creation and card-add risk scoring |
| Authorization | High-resale-value or digital basket; expedited shipping; first purchase on card at high amount; issuer response codes | Pre-authorization risk score; 3DS step-up or decline |
| Fulfillment | Shipping to forwarders or drop addresses; address change after order; buy-online-pickup by a third party | Hold before ship or before digital delivery; Manual Review Queues |
| Account funding | Card-funded deposit followed quickly by withdrawal, P2P send, crypto purchase or trade-and-withdraw | Funds Availability Holds on card-funded balances; Withdrawal and Payout Controls |
| Post-transaction | Fraud reports (TC40/SAFE), issuer alerts, chargebacks under fraud codes | Refund before chargeback when alerted; label feedback into models |
At a neobank, brokerage or P2P wallet, account funding takes the place of shipping goods, and a card-funded deposit is a purchase of money. If the platform lets that balance move out (withdrawal to a different bank, P2P send, crypto, or a securities trade that can be liquidated and withdrawn) before the dispute window matures, the platform is shipping cash to a stolen card.
Common variants
| Variant | What's different | Where it shows up |
|---|---|---|
| Physical goods | Reshipping, forwarders, BOPIS pickup by mules | Retail, electronics, luxury |
| Digital goods and stored value | Instant delivery; gift cards, game currency, tickets, subscriptions | Digital merchants; see Gift Card Fraud |
| Card-funded account deposits | Stolen card funds a wallet or brokerage account; value exits via other rails | Neobanks, brokerages, P2P, crypto on-ramps |
| Stored-card ATO | Fraudster spends a victim's saved card inside their own account | Any merchant with card-on-file; see Account Takeover (ATO) |
| Rewards-funded CNP | Stolen cards used to generate qualifying purchases for cashback, points or card-linked offers | Card-Linked Offer Abuse, Loyalty and Rewards Redemption Fraud |
| Marketplace laundering | Stolen cards buy from a colluding or fake seller; payout is the cash-out | Seller Non-Delivery and Fake Listings, Fraud Rings and Collusion |
| Tokenized CNP | Stolen card provisioned to a wallet, then used in-app or online | Digital Wallet Provisioning Fraud |
Where it shows up
- Retail and Ecommerce: the merchant carries the loss, and fraud screening sits in the checkout latency budget.
- Online Marketplaces: CNP is both a buyer-side loss and a seller-side laundering path; payout timing is the control that matters.
- Cashback, Coupons and Rewards: rewards platforms may never touch the card directly, but CNP-funded purchases produce cashback that pays out before the merchant's chargeback lands. If a merchant reverses the commission, the platform holds the loss on any cashback already paid.
- Neobanks and Consumer Fintech and Payments and P2P: debit/credit card "add money" is the funding vector; P2P send is the exit. Speed of the exit is the risk.
- Brokerage and Investing: card funding is less common but growing (debit card instant deposits). The trade-then-withdraw path converts card credit into ACH or wire outflows.
Impact
- Direct loss: goods or value delivered plus the chargeback amount and fee.
- Network exposure: fraud reports count toward network monitoring. Visa's VAMP (from April 1, 2025) combines fraud and dispute counts against CNP volume, and merchant Excessive thresholds tightened in 2026 (Rapyd; Chargeflow).
- Consumer scale: FTC reports show credit cards were the most frequently reported payment method in 2025 fraud reports, even though bank payments and crypto drove the most dollar losses (USA Today via AOL, 2026). In 2024 the FTC recorded about $275 million in reported credit card losses (ABA Business Law Today, 2026). That's a small share of consumer-reported losses because cardholders are well protected, so the loss lands on merchants and issuers instead.
- False positives: declines and step-ups on good customers often cost more than fraud itself. See Friction and Customer Experience Tradeoffs.
Red flags
- Identity elements that don't fit together (name, email, phone, billing, shipping, IP geography) → Identity Element Consistency, Address Risk Signals, Email Risk Signals
- New device, new account, new card and high value, all at once → Customer Tenure and History, Device Fingerprinting
- Card attributes: prepaid or foreign BIN vs. stated location, card recently added, many cards per account → Payment Instrument Signals, Velocity Signals
- Prior chargebacks or refund abuse linked to the account, device or card (also critical for separating CNP fraud from friendly fraud) → Dispute and Return History
- Resale-friendly baskets, digital stored value, quantity anomalies → Basket and SKU Anomalies
- Card-funded balance moving out fast → Fast In Fast Out Patterns
- Linked accounts sharing cards, devices or addresses → Entity Link Analysis
Prevention and detection at a glance
| Layer | Control or signal | What it does here |
|---|---|---|
| Prevent | 3-D Secure and Card Verification | Authentication on risky transactions; liability shift for authenticated fraud |
| Prevent | Velocity and Exposure Limits | Caps first-week card-funded amounts and cards per account |
| Prevent | Funds Availability Holds | Holds card-funded balances or digital delivery until risk clears |
| Detect | Real-Time Transaction Risk Scoring, Machine Learning Models | Pre-auth scoring on device, identity, basket and history |
| Detect | Manual Review Queues | Human review for high-value, ambiguous orders before fulfillment |
| Respond | Withdrawal and Payout Controls | Blocks fast exit of card-funded value |
| Respond | Network alerts and refunds | Refund-on-alert avoids a chargeback and its count; see Card Network Dispute Rules |
Emerging variants and adversary adaptation
- Phishing replaces breaches as the freshest supply. Live-phished card data, often captured with the one-time code needed to push through authentication or tokenization, is monetized within days rather than months (KrebsOnSecurity, 2025). Shorter time-to-fraud means label delays hurt more.
- Socially engineered 3DS. When fraudsters socially engineer one-time codes, the attacker can pass 3DS challenges. Liability may shift to the issuer, but the fraud still happens, so merchants should not treat a successful challenge as proof of legitimacy for fulfillment or payout decisions.
- Card funding as a mule on-ramp. Card-funded deposits into fintech accounts, followed by P2P or instant payouts, combine CNP with Real-Time Payment Rail Fraud and Money Mules.
- Network programs reward data-rich merchants. Programs like Visa CE 3.0 and Mastercard First-Party Trust let merchants win disputes that are really friendly fraud, which raises the stakes on labeling disputes correctly. See Chargeback and Friendly Fraud.
- Agent-initiated checkout introduces new questions about who authorized a card-not-present transaction; see Agentic Commerce Fraud.
Related mechanisms
- Card Testing → Card-Not-Present Fraud → chargeback is the classic sequence.
- Digital Wallet Provisioning Fraud and Gift Card Fraud are the most common ways to convert a card into something harder to claw back.
- Triangulation Fraud and Refund and Return Fraud are adjacent commerce-side patterns.
- Instant Funding Abuse (Kiting) when the card funds an account balance that becomes available before settlement.
Real-world examples
- FTC Consumer Sentinel data for 2024 shows credit cards accounting for roughly $275 million in reported consumer fraud losses, versus roughly $2.1 billion for bank transfers and payments (ABA Business Law Today, 2026). Card fraud is a business loss problem more than a consumer one.
Sources and further reading
- Rapyd: Visa Acquirer Monitoring Program: VAMP ratio construction and thresholds
- Chargeflow: VAMP explained: VAMP enforcement timeline
- KrebsOnSecurity: How phished data turns into mobile wallets (2025): compressed time-to-fraud for phished cards
- ABA Business Law Today: Consumer Sentinel data (2026): 2024 losses by payment method
- USA Today via AOL: Americans lost a record $15.9 billion to scams in 2025: FTC 2025 figures; credit cards most frequently reported method
- Adyen: Visa Compelling Evidence 3.0 FAQ: 10.4 dispute evidence model
- See also Card Network Dispute Rules and Fraud Labeling and Feedback Loops