cardnotpresent

Card-not-present (CNP) refers to payment transactions where the consumer’s physical card is not presented to the merchant at the time of authorization. This contrasts with card-present transactions, where the card is physically presented through a swipe, dip, or contactless tap. CNP payments are common in online stores, e-commerce marketplaces, mail order, telephone orders, and in some recurring billing scenarios.

In CNP transactions, the merchant typically collects card details such as the card number, expiration date, and sometimes the card verification value (CVV). The information is transmitted through payment gateways or processors to the card network and issuer for authorization. Because sensitive data may be handled remotely, merchants often rely on tokenization and encryption to reduce exposure of card data and to support compliant storage.

Security and risk management for CNP payments emphasize additional fraud controls. Measures commonly used include the CVV check, address verification service (AVS), and stronger authentication such as 3D Secure. Tokenization and PCI DSS compliance help minimize data exposure, while risk scoring, device fingerprinting, and manual reviews can deter fraud. CNP environments may support recurring payments and use token-based rails to avoid storing full card data.

Compliance and liability in CNP transactions are shaped by card network rules and regulatory standards. PCI DSS applies to merchants and service providers handling card data, with specific Self-Assessment Questionnaires (SAQ) guiding compliance based on data handling. Because CNP transactions typically carry higher fraud risk, proper controls and authentication are important to reduce chargebacks and liability.