A card-not-present transaction is any card payment where the customer and the physical card aren’t at your checkout when the sale happens. Online checkouts, phone orders, mail orders, invoices paid by card, and recurring subscription charges all count. Because you can’t see the card or the buyer, these payments carry more fraud and chargeback risk, and they’re priced and protected differently than in-person sales.
This guide explains how card-not-present (CNP) payments work, how they compare with card-present sales, what they cost, the rules that apply, and a practical checklist for accepting them safely.
Key takeaways
- Card-not-present means the card isn’t physically presented to you. E-commerce, phone, mail, invoice, and recurring payments are all CNP.
- Remote card payments now move more money than in-person card payments in the U.S., so most online businesses run mostly or entirely on CNP sales.
- CNP payments usually cost more to process and carry more fraud risk, because you can’t verify the chip or the buyer face to face.
- Tools such as AVS, CVV checks, 3-D Secure, and gateway fraud filters lower that risk. Clear policies and receipts lower chargebacks.
- You need a merchant account set up for CNP sales, a payment gateway or virtual terminal, and PCI DSS-compliant handling of card data.
What is a card-not-present transaction?
In a card-present sale, the customer taps, dips, or swipes a physical card at a terminal. The terminal reads data straight from the card’s chip or stripe, which is hard to fake. In a card-not-present transaction, the customer (or your staff) types the card number, expiration date, and security code into a checkout page, app, or virtual terminal. Nobody reads the card itself.
That difference matters to banks and card networks. Without the chip, a card-not-present transaction offers less proof that the person paying is the real cardholder. So CNP sales get their own fraud tools, their own pricing, and their own rules for who absorbs the loss when a payment turns out to be fraudulent.
The PCI Security Standards Council groups these sales under “card-not-present environments, such as mail-order/telephone-order and e-commerce,” and notes that each of these channels must be evaluated and protected under PCI DSS (PCI SSC merchant resources).
Common types of CNP payments
- E-commerce checkouts: a shopper enters card details on your website or in your app. This is the core of e-commerce and DTC payment processing.
- Phone orders (MOTO): a customer reads their card number to your team, who keys it into a virtual terminal.
- Mail or fax orders: less common today, but still CNP.
- Invoices and payment links: a client clicks a link in an email and pays by card. Agencies and professional and high-ticket service firms use these heavily.
- Recurring and stored-card charges: a card on file is billed automatically for a subscription, membership, or installment plan.
- In-app and digital wallet payments online: a wallet used in a browser or app is still a remote payment, even though the wallet adds its own security layer.
How does a card-not-present payment work?
The flow is close to a normal card sale. The difference is how the card data enters the system and which checks run along the way. Here is how a card-not-present transaction moves from checkout to your bank account:
- The customer enters card details on your checkout page, payment link, or app, or gives them to your team by phone.
- Your payment gateway encrypts the data and sends it to your processor. A payment gateway such as NMI or Authorize.net is the online equivalent of a card terminal.
- Fraud checks run. Depending on your setup, this can include address verification (AVS), the card security code (CVV), 3-D Secure authentication, and custom gateway filters.
- The card network routes the request to the bank that issued the card, which approves or declines it.
- You fulfill the order and the funds settle to your business bank account through your merchant account, usually within a few business days.
Get matched with processing partners through one simple application. Interchange-plus pricing from 0.40% + $0.10.
Card-present vs card-not-present transactions
The table below shows the practical differences a business owner will notice. Exact pricing depends on the card type, your industry, and your processor, so treat this as a general comparison rather than a rate sheet.
| Factor | Card-present | Card-not-present |
|---|---|---|
| How card data is captured | Chip, tap, or swipe at a terminal | Typed into a website, app, payment link, or virtual terminal |
| Main proof of the cardholder | Physical card and chip data | Card number, CVV, billing address, and optional 3-D Secure authentication |
| Fraud risk | Lower; chip cards are hard to counterfeit | Higher; stolen card numbers can be used remotely |
| Processing cost | Generally lower interchange | Generally higher interchange because of the added risk |
| Fraud chargeback exposure | Lower for properly processed chip sales | Merchant often bears the loss unless the payment was authenticated |
| Equipment needed | Card terminal or POS system | Payment gateway, hosted checkout, or virtual terminal |
| Typical businesses | Brick-and-mortar stores, restaurants | E-commerce, SaaS, subscriptions, online courses, service firms |
How common are card-not-present payments?
Very common, and growing. According to the Federal Reserve’s payments study update, the number of remote card payments rose by 8.7 billion (almost 24 percent) in 2020, while in-person card payments fell by almost 13 percent. That year, the total value of remote card payments passed the value of in-person card payments for the first time, driven mainly by e-commerce.
For online-only brands, nearly every sale is CNP. That’s why picking the right processing setup, fraud tools, and processing partner for each card-not-present transaction matters more for them than for a store with a counter and a terminal.
Why card-not-present transactions carry more risk
When chip cards spread in the U.S., counterfeit fraud at stores fell, and criminals shifted online. The Federal Reserve reported that remote card fraud rose from $3.4 billion in 2015 to $4.6 billion in 2016, while in-person card fraud fell from $3.7 billion to $2.9 billion over the same period. Stolen card numbers are easy to use where nobody checks the physical card.
For you, that risk shows up in three ways:
- Fraud chargebacks. When the real cardholder disputes a charge they didn’t make, the money is usually pulled back from you, plus a chargeback fee.
- “Friendly fraud” and service disputes. Real customers sometimes dispute charges they forgot, didn’t recognize on their statement, or regret. Remote sales make these disputes easier to file and harder to rebut without good records.
- Account health. Card networks and banks track dispute levels. If yours climb too high, you can face fees, reserves, or monitoring programs. Our guide to the chargeback ratio and its thresholds explains how this is measured.
Some business models raise CNP risk further: recurring billing, free trials, high-ticket services delivered later, and products like supplements. That’s a big reason these sellers often need a high-risk merchant account instead of a standard one. If you’re unsure where you fall, read what makes a business high-risk for card processing.
Card-not-present transaction fees and pricing
Every card payment includes interchange (paid to the card-issuing bank), network assessment fees, and the processor’s markup. Card networks generally set higher interchange categories for card-not-present sales than for chip or tap sales, because the issuer takes on more risk. You may also see gateway fees per transaction and charges for optional fraud tools.
The cleanest way to see what CNP sales really cost is interchange-plus pricing, which passes the actual interchange through and shows the processor’s markup separately. Our explainer on interchange-plus pricing walks through how to read it, including what each card-not-present transaction costs you on a statement.
Rules that apply to card-not-present sellers
PCI DSS applies to every CNP channel
PCI DSS covers all merchants that accept cards, whatever their size. The PCI Security Standards Council also notes that whether a small merchant must formally validate compliance is set by the individual card brands, so check with your acquirer. A hosted payment page or tokenized gateway that keeps raw card numbers off your servers can reduce how much of your setup falls in scope. Never store CVV codes or write card numbers on paper or in email.
The FTC’s shipping rule for remote orders
If you sell physical goods online, by phone, or by mail, the FTC’s Mail, Internet, or Telephone Order Merchandise Rule applies. If you don’t state a shipping time, you must have a reasonable basis to ship within 30 days. If you can’t ship on time, you must notify the customer and get consent to the delay or offer a cancellation and refund. For card purchases on a card issued by a third party, refunds on canceled orders are due within seven working days. Following this rule also cuts “item not received” chargebacks.
Authentication with 3-D Secure
3-D Secure (EMV 3DS) lets the card issuer confirm the buyer is the rightful cardholder, often in the background, sometimes with a one-time code. Visa’s version, Visa Secure, is designed to “help prevent card-not-present fraud” while keeping friction low for consumers. Under card network rules, authenticated transactions can shift liability for certain fraud chargebacks to the issuer. The details vary by network and transaction, so confirm how it applies to your account with your processor.
How to accept card-not-present transactions safely: a checklist
Use this checklist when you set up or review your online and phone payment flow. Most items cost little and pay for themselves in fewer disputes.
- Get a merchant account approved for CNP sales. Describe your real sales channels (online, phone, recurring) on the application so your account is set up correctly. Payment Circle works with new U.S. online businesses.
- Use a secure gateway with tokenization. Let the gateway store card data so your systems don’t.
- Turn on AVS and CVV checks. Decide in advance which mismatch results you’ll decline or review.
- Add 3-D Secure where it fits, especially for first-time buyers and high-value orders.
- Set velocity and amount filters to flag many attempts from one IP address or card, or orders far above your normal ticket size.
- Use a clear billing descriptor that matches your brand name and includes a phone number or website, so customers recognize the charge.
- Publish your policies (refunds, cancellations, shipping, subscription terms) at checkout, and get clear consent for recurring billing.
- Keep records such as IP address, delivery tracking, login history, and signed agreements. They’re your evidence if a dispute comes in.
- Train phone staff. Key card details straight into the virtual terminal; never write them down or send them over email or chat.
- Watch your dispute numbers monthly and act early with refunds or alerts. A chargeback management program helps here.
Common mistakes to avoid
- Applying for a retail-style account and then running mostly online or phone sales.
- Setting fraud filters so tight that good customers get declined, or so loose they catch nothing.
- Using a billing descriptor that doesn’t match your website name.
- Hiding cancellation terms for subscriptions, which drives disputes.
- Shipping late without notifying customers, which breaks the FTC rule and invites chargebacks.
Worked example: a subscription brand selling online and by phone
Picture a small supplement brand that sells a monthly bundle on its website and takes reorders by phone. Every sale is card-not-present. Here’s how it might set up:
- Website checkout: a hosted payment form from its gateway, with AVS, CVV, and 3-D Secure on first orders.
- Phone reorders: staff key cards into a virtual terminal, read back the order total, and send an email receipt right away.
- Recurring billing: card-on-file charges with clear consent at signup, a reminder email before each renewal, and one-click cancellation. Our page on subscription payment processing covers this model in more depth.
- Monthly review: the owner checks declines, disputes, and refund reasons, then adjusts filters.
Because supplements and continuity billing are higher-risk categories, this brand would likely apply for a high-risk account and expect a closer underwriting review. Being upfront about its sales channels and billing model is what keeps that review smooth.
Virtual terminal or payment gateway for CNP sales?
Most online businesses use both. A payment gateway connects your website, cart, or app so customers pay themselves. A virtual terminal is a secure web page where your team enters card details for phone orders or invoices. If you’re choosing a gateway, our comparison of NMI vs Authorize.net covers the two gateways Payment Circle supports. Either way, every card-not-present transaction should pass through the same fraud checks.
Related guides and next steps
- Need an account for online sales? See how Payment Circle sets up merchant accounts for online businesses.
- Selling subscriptions, supplements, or high-ticket services? Learn about high-risk merchant accounts.
- Taking phone orders? Learn what a virtual terminal is and how it compares to a POS system, then explore our virtual terminal.
- Fighting disputes? Read how to reduce payment processing chargebacks.
- Getting ready to apply? Use the merchant account approval checklist.
Frequently asked questions
Is an online payment a card-not-present transaction?
Yes. Any payment where the card details are entered on a website or in an app, rather than read from the physical card at a terminal, is card-not-present. That includes one-time purchases, invoices paid online, and recurring charges.
Is a phone order card-present or card-not-present?
Phone orders are card-not-present, even if you key them into a terminal. They’re often called MOTO (mail order/telephone order) transactions. Use a virtual terminal and never write the card number down.
Why are card-not-present fees higher?
Card-issuing banks take on more fraud risk when the card isn’t verified in person, so card networks generally assign CNP sales to higher interchange categories. Gateway fees and fraud tools can add to the cost as well.
Who pays for card-not-present fraud?
In many cases the merchant does, through a fraud chargeback. Authenticating payments with 3-D Secure can shift liability for certain fraud disputes to the card issuer under network rules. Ask your processor how this applies to your account.
Do I need a special merchant account for card-not-present sales?
You need a merchant account that’s approved for the way you actually sell, plus a gateway or virtual terminal. Tell your provider your channels and billing model upfront. Higher-risk online models may need a high-risk account.
Sources and further reading
- Federal Reserve: Federal Reserve Issues Update to Payments Study (2021)
- Federal Reserve: Payments Study on U.S. Payments Fraud (2018)
- PCI Security Standards Council: Merchant Resources
- Federal Trade Commission: Business Guide to the Mail, Internet, or Telephone Order Merchandise Rule
- Visa: Visa Secure
Ready to accept card-not-present payments?
Payment Circle helps new U.S. online businesses set up merchant accounts with interchange-plus pricing, simple contract terms, and NMI or Authorize.net gateways. Start your application, or call us at (571) 274-7950 (9:00 AM to 6:00 PM Eastern). You can also send us a message.
Tell us about your business and we’ll match you with processing partners suited to your industry and volume.