CNP refers to a transaction made through a website or through the payment page within a company's own application, where the card is not read by any device (the card details are entered manually).
It is short for Card Not Present. At the moment of the transaction, the card is not passed through any device (POS, kiosk, etc.).
These kinds of transactions are carried out by verifying the CVV2 information.
The fraud risk in CNP transactions is higher than in physical transactions. For this reason, it is beneficial to carry out CNP transactions as 3D Secure.
Types of CNP transactions
Transactions where the card is not presented physically are not all of a single type:
- E-commerce transactions: Purchases made through websites or mobile applications.
- Mail order and telephone orders: Transactions where the card details are conveyed to the merchant through a form or over the phone.
- Recurring payments: Transactions such as subscriptions and standing payment instructions, where the card details are captured once and used on a regular basis.
Liability in CNP transactions
In physical transactions, the chip and PIN largely prove that the cardholder actually carried out the transaction. In CNP transactions, there is no such proof. For this reason, when a cardholder disputes a transaction by claiming “I did not make this transaction,” liability generally remains with the merchant. When the cardholder is verified through 3D Secure, however, this liability largely shifts to the issuing bank.
Methods that reduce risk in CNP transactions
- Verifying the cardholder through 3D Secure with the cardholder's bank
- Storing card details as a token rather than at the merchant
- Performing risk analysis using data such as delivery address, IP address, and device information
- Subjecting transactions with an unusual amount or frequency to additional checks
