What is CNP Fraud? 

Definiția fraudei Card-Not-Present (CNP) acoperă tranzacțiile care implică informații despre cardul de plată, pentru care cardul fizic nu este o condiție prealabilă, iar autorizarea titularului cardului nu este obținută. În situațiile de cumpărături online, telefonice sau prin poștă, comercianții procesează digital informațiile cardului pentru tranzacțiile în care lipsește un card fizic. Sistemul permite tranzacții care încorporează numere specifice de card, date de expirare, coduri CVV și adrese de facturare, care pot proveni din diverse canale sau canale non-standard.

For example, a CNP transaction is when you pay via the internet or mobile, where your card is not read at the point of sale by a terminal. The main factor that differentiates it from other transactions is that the cardholder and their card (physical one) are not in the scene of data exchange.

•       Typical CNP situations are:
•       Paying at online stores
•       Placing phone orders
•       Ordering via mails
•       Manual keying of card details
•       Wallet digital payments on the web or via the application

Understanding the most common methods used to obtain payment data helps businesses strengthen their fraud prevention strategies and reduce risk.

• Certain email types and simulated online transaction forms may facilitate the input of user payment data.
• Testing stolen credentials using automated card testing tools or compromised merchant scripts to identify valid payment information.
• Fraudulent transactions, when they imitate legitimate customer behavior, typically necessitate advanced monitoring for effective detection.
• Attempting multiple transactions from the same card or IP address, which can often be identified and blocked through velocity rules and real-time fraud detection systems.

By understanding how these techniques function, businesses can implement security measures that address risk levels, alongside considerations for customer interactions.

Information regarding the impact of card-not-present (CNP) fraud is relevant for businesses developing prevention strategies and addressing aspects of long-term growth. While CNP fraud can lead to financial losses, effective risk management minimizes its impact and strengthens customer trust. High-value, easily resellable goods typically require additional protection, making proactive fraud detection and prevention essential for maintaining healthy margins and delivering a secure customer experience.

A successful strategy should be multi-layered, combining several lines of defense: strong verification of the cardholder’s identity, monitoring transactions, and intelligent application of authentication when a customer or user reaches a certain point.

Cele mai bune practici includ:

•       Require verification of CVV/CVC
•       Utilizați the Address Verification Service (AVS)
•       Monitor transaction velocity
•       Make use of advanced tools such as device fingerprinting, IP tracking, and behavioral ​‍​‌‍​‍‌profiling

3D Secure (3DS) is a system that stops CNP fraud by requiring a verification step before payment approval. The bank can check the physical presence of the cardholder using an authentication device in real time. The system uses risk-based authentication to determine whether a transaction will pass without hurdles or require an additional challenge.

Redefinition of payment method initiation can be important. Tap-to-pay with Apple Pay in-store is largely viewed as a card-present transaction, whereas Apple Pay online or in-app purchases are usually card-not-present. Even though Apple Pay relies heavily on tokenization, biometrics, and Secure Element-based authorization, such features can only enhance security and cannot influence the transaction channel classification.

When CNP fraud occurs, merchants typically address fraud and chargebacks. Depending on card network rules, transaction authentication situation, and dispute reason code, liability varies.

•       Federal law establishes a consumer liability limit of USD 50 in most instances, with many card issuers also providing a zero-liability policy.
•       The merchant’s fraud liability is shifted to the card issuer after the consumer fraud is successfully detected and challenged through a 3D Secure authentication.
•       For transactions that are not authenticated or have failed, the merchant typically manages the resulting financial differences.

Contact your bank as soon as an unauthorized charge is identified so the card transaction dispute can be done quickly and effectively. Federal regulations typically stipulate that a dispute be submitted within two months following the statement’s generation.

What actions a consumer should take:

1)   În primul rând consumer’s initial action is reporting the unauthorised transaction to the issuer.

2)   If contesting this transaction is considered appropriate, a formal written dispute should be submitted within two months of the statement date.

3)   The action of stopping a compromised card is typically to place it in a frozen state.

4)   Regularly reviewing statements and monitoring the situation to identify subsequent irregularities.

Most creditors provide arrangements for zero customer liability for unauthorized card transactions. Merchants, conversely, can contest chargebacks by providing documentation such as AVS/CVV verification responses, device details, and shipping records.