Card-Not-Present (CNP) Fraud

At a shop counter the chip, PIN or signature gives some assurance that the holder is present. Online and phone sales have no such proof, so a thief who has only the card number, expiry date and security code can place orders. The details usually come from data breaches, phishing or skimming devices. Criminals often test small amounts first, then make larger purchases of goods that are easy to resell, such as electronics and gift vouchers. Merchants and issuers counter it with extra authentication, such as one-time passwords, address matching, device and velocity checks, and risk scoring. Where a genuine cardholder disowns the sale, liability often falls on the merchant through a chargeback. Merchants selling digital goods that ship instantly feel it first, since there is no parcel to stop once the order is approved.

An online electronics seller receives forty orders in one afternoon, each paid with a different card but shipped to the same address through a parcel locker. All use freshly created accounts. The risk engine holds the orders for review. A few days later several card issuers report that their cardholders never made these purchases, and the seller cancels the remaining shipments before dispatch.