Card-not-present payments 101: The basics of online card transactions

The cost of CNP payments is a huge deal for merchants. Accepting payments online usually costs more than accepting them in a store. This is because the risk of fraud is higher, so financial institutions and processors charge higher fees to cover that risk. These costs include processing fees paid to the payment gateway and interchange fees paid to the financial institution. Because these costs add up, managing them is a top priority for businesses. In fact, one of the main reasons merchants encourage customers to use specific payment methods like debit cards or local bank transfers is to lower these processing costs.

For a small to medium-sized business (SMB), fraud hits hard. Unlike big companies with huge budgets, an SMB might not have a dedicated fraud team. They have to spend valuable time on CNP fraud prevention instead of growing their business. When fraud happens, the business often loses the product (which the thief stole) and the money too (which the bank takes back), called a chargeback. Furthermore, in an attempt to stop fraud, they might accidentally block good customers, which can hurt sales revenue. These operational challenges and costs are likely to be an ongoing concern for many smaller merchants who are trying to compete in a risky digital world. 

There are specialized providers who build the technology that keeps online shopping safe, such as Visa and its affiliates. Visa Protect includes tools like Decision Manager to help merchants automatically spot fraud. Verifi specializes in post-purchase solutions—for example, preventing chargeback fraud by sharing transaction data in real time . Then there is CardinalCommerce, which focuses on authentication (like EMV 3-D Secure) to ensure that the person using the card is legitimate. Visa and its affiliates work together to offer everything from risk scoring to dispute resolution, helping merchants of all sizes navigate the world of CNP transactions.

To accept CNP payments safely, merchants should follow a multi-layered “defense-in-depth" approach. First, validate the data. Always check that the billing address matches the card's records and that the three-digit CVV code is correct. Second, use authentication like EMV 3-D Secure to challenge risky orders while letting safe ones pass through quickly. It is also best practice to monitor patterns. If a single account is trying to make ten purchases in one minute, or if a user is trying different card numbers rapidly (velocity checks), they might need to be blocked. Finally, educate your customers. Remind them to keep their accounts secure and update their profiles. By combining strict data checks with active monitoring, merchants can accept more good orders, while shutting the door on more of the fraudulent ones.

Verifying that a customer is who they say they are is the best way to reduce fraud. The industry standard for this is EMV 3-D Secure (3DS). This technology assesses the risk of a transaction. If it looks safe, the customer doesn't do anything. If it looks risky, they verify themselves using a one-time passcode sent to their phone or by using biometrics like a fingerprint or face scan on their banking app. Other effective methods include an account name inquiry, which checks if the name on the order matches the name on the bank account. Merchants can also check the device ID or mobile phone number linked to the user's name. These layers of verification make it very hard for a thief with a stolen card number to successfully check out.

When a cardholder sees a transaction they didn't make, they initiate a dispute (or chargeback) with their bank in order to get their money back. For the merchant, this means losing the money and paying a fee. However, merchants can fight invalid disputes. If a customer claims they didn't receive their purchase but actually did (friendly fraud), the merchant can use compelling evidence like a delivery signature, device ID, or history of previous undisputed purchases from the same IP address to help prove that the customer could be misrepresenting the situation.

Mobile wallets with Apple Pay and Google Pay can be used when shopping online for a fast and secure checkout experience—and this counts as card-not-present. However, when a customer uses a digital wallet in your store, it counts as a card-present transaction. CP transactions using digital wallets are kept secure by using tokens to protect customers’ information, and by adding an extra layer of authentication such as biometrics. Ensuring your terminals and checkout support digital wallets helps reduce fraud risk, improve customer trust and speed up checkout.

Those three or four little numbers on the back or front of credit or debit cards are used to verify card-not-present transactions, and are a common target for fraud. A dynamic CVV reduces this risk by replacing the static codes with a random code that changes periodically. Codes can be generated via a customer’s mobile banking app, or within a small screen on the card itself. Because the CVV changes frequently, a stolen code quickly becomes useless, significantly reducing fraud risk.

Yes, customers can use their dynamic CVV to set up recurring payments such as gym memberships. The cardholder simply enters their temporary code for the first payment to be accepted, then your businesses will be able to take payments automatically in future—even when the code has changed.

A payment gateway (such as Authorize.net) acts as a secure bridge between your business and the payments ecosystem to connect key players. These include the customer, the store owner, the issuer (the customer’s credit card bank), the acquirer (the merchant bank), and the card network (Visa). When your business uses a payment gateway, it can process and accept payments, while providing tools like transaction management, reporting and billing. For online and card not present transactions, a gateway is essential. For in store payments, transactions are typically handled by a POS system and processor, though some setups route data through a gateway for centralized reporting or mobile checkout.

How soon you can start accepting payments depends on factors like how quickly your gateway can approve your account and whether you have an existing merchant account (needed to accept credit cards). For example, Authorize.net can approve your account automatically once the application is completed successfully, then you can be ready in a few minutes simply by updating your gateway with the parameters provided by your merchant provider. Merchant accounts can take up to five business days to open, subject to factors like what industry you work in, or your credit history. 

An acquirer (or acquiring bank) is a financial institution that processes card payments on behalf of your business. It processes and settles payments made by your customers via their issuing bank by communicating between the merchant, and a card payment network, like Visa.

No, acquirer bundling is not required for your business to accept payments, but for some it’s a quicker and easier way to get started. Traditionally, services like merchant accounts, payment gateway and payment processing were sourced separately. Today, a payment service provider might offer an all-in-one package, known as “acquirer bundling”, but this may not suit someone who already has a merchant account or prefers to keep things separate. Authorize.net offers bundled options that may be approved quickly if the application qualifies for auto-approval, but it can also be used independently with an existing merchant account.