Card-Not-Present (CNP) Transaction

What a card-not-present transaction is

A card-not-present (CNP) transaction is a card payment where a payment terminal does not electronically read the card. The customer might pay on your website or app, give you card details by phone, mail an order with those details, or use a card saved for a recurring charge. These are all CNP, even when you have the customer’s card number and security code.

The transaction type depends on how the card data is captured, not just where the customer is standing. If a customer hands you a card but you key in its details instead of reading the chip or tap, the payment is CNP. A chip insert, swipe, or contactless tap at a reader is card-present.

CNP describes how the card data was captured, and that classification can affect both your processing costs and fraud exposure.

How the payment is classified

CNP payments rely on card details and digital signals rather than a terminal reading the card. At checkout, you can collect the expiration date, security code, and billing address. Address Verification Service (AVS) compares the billing address information with the issuer’s records. 3-D Secure can add an issuer authentication step, such as a code or other verification.

A digital wallet payment is not automatically CNP. When the customer taps a wallet at a payment terminal, the terminal reads the payment credential and the transaction is card-present. A remote wallet payment through an app or website is CNP.

What it means for your costs

CNP processing commonly costs more than card-present processing because the card and customer are not verified at a physical reader, increasing fraud risk. There is no single CNP rate: your charge depends on the card, transaction details, and your processor’s pricing. A CNP label alone does not tell you how much extra you pay.

Your card costs have three layers: interchange paid to the issuing bank, network fees, and processor markup. Only the markup is negotiable. Review the pricing structure and compare the markup on remote sales with your card-present sales. On interchange-plus pricing, the underlying interchange and markup are shown separately; a bundled rate can conceal the difference.

Where the risk shows up

A fraudster with stolen card details can place an order remotely without presenting the card. If the real cardholder disputes the charge, you can lose the sale amount and the goods or service, and face a chargeback fee. Under Visa and Mastercard rules, cardholders generally have 120 calendar days to dispute a transaction, with longer outer limits for some delayed-delivery cases, as of 2026.

Use AVS and card security code checks where appropriate, and apply 3-D Secure when it fits your checkout. Network tokenization can replace the card number with a merchant-specific token, reducing exposure of the original number. These checks reduce some risks, but they do not guarantee that a payment is legitimate or prevent every dispute.

What you can actually change

1. 01
   Separate the pricing. Compare the processor markup on CNP and card-present sales. Interchange and network fees are not negotiable, but the processor markup is.
2. 02
   Tighten checkout checks. Use AVS, card security code checks, and 3-D Secure where they fit your checkout flow. Review declines and abandoned orders so added verification does not block too many legitimate buyers.
3. 03
   Limit stored data. Use tokenization for repeat payments where available instead of retaining raw card numbers. This reduces exposure of the original card number if stored payment data is compromised.
4. 04
   Track disputed sales. Compare CNP sales, fraud reports, and chargebacks each month. A rise in disputes can cost you sales and fees, and can trigger card-network monitoring.

Frequently asked questions