The short answer
When a card isn't physically there, the merchant usually carries the cost of fraud. You stop most of it with layers, not one tool:
- Know the warning signs and look twice when several show up on one order. One sign alone usually means nothing.
- Turn on AVS, CVV and velocity limits in your payment gateway, so bots can't test stolen cards on your checkout.
- Use 3-D Secure where it fits. Under Visa's rules, a fraud dispute on a fully authenticated online payment is invalid, so the loss moves off you.
- Act before the dispute. If you find a fraudulent sale, refund it and don't ship.
What Card-Not-Present Fraud Is, and Why the Merchant Pays
A card-not-present (CNP) payment is any sale where you never see the card: website, phone, mail or virtual terminal. Fraud happens when someone uses stolen card details or a hijacked account.
Online, you only have what the buyer typed in. So when the real cardholder tells their bank "I didn't make this purchase," the money usually comes back out of your merchant account. Visa files these disputes under condition 10.4, "Other Fraud – Card-Absent Environment."
There are two kinds to plan for:
- Criminal fraud: a stranger uses someone else's card. The warning signs and filters below are built for this.
- Friendly fraud: the real cardholder buys, then disputes the charge. Filters can't catch it, because nothing about the order is fake. See friendly fraud below.
12 Warning Signs of Card-Not-Present Fraud
Every one of these also shows up on good orders, so treat each sign as a reason to look closer, not to decline. Two or three together is when to stop and check.
| Warning sign | Why fraudsters do it | Why a good customer might too |
|---|---|---|
| 1. New customer, much bigger order than usual | A stolen card works only until it's reported, so they spend as much as they can at once | New customers find you every day, and some buy big |
| 2. Several of the same item, or only high-value items | Easy to resell, so more profit per stolen card | Resellers, teams, offices and gift buyers |
| 3. Rush or overnight shipping | They want the goods before the cardholder notices, and the shipping cost isn't their money | Deadlines, events and forgotten birthdays |
| 4. Shipping address differs from the billing address | The card belongs to someone else, so the goods can't go to the cardholder | Gifts, work addresses, second homes |
| 5. International shipping, a freight forwarder, or a card from another country | Goods are harder to trace or recover | Real overseas buyers, and expats using a forwarder |
| 6. AVS or CVV doesn't match, or the expiration date fails | They have the card number but not the full card details | A recent move, a typo, or a bank that doesn't return a result |
| 7. Several cards sent to one shipping address | One drop address for a batch of stolen cards | A family or business paying with different cards |
| 8. One billing address with many cards and many shipping addresses | Points to a group working together, not one person | Rarely innocent. Worth a call every time |
| 9. Several cards from one IP address or device | One person trying card after card until one works | Shared office or campus networks, or a buyer whose first card was declined |
| 10. Many attempts on one card in a short time, or a small charge then a big one | Checking the card works, then using it before it's closed | A customer who mistyped a few times, or buys a sample first |
| 11. Card numbers that are nearly the same, one after another | Software generating numbers to guess valid cards (card testing) | Almost none. This is a bot |
| 12. An email or phone that doesn't fit the buyer | Throwaway accounts leave no trail. On phone orders, a caller who can't say whether the card is Visa or Mastercard may be reading a stolen number | Most people use free email, so a free email address on its own proves nothing. Look for a new, random-looking address that doesn't match the name |
Card Testing Attacks and Velocity Limits
Card testing is when a bot runs stolen or generated card numbers through your checkout, often for a dollar or two, to find which ones work. Signs 9, 10 and 11 above are what it looks like: a burst of small payments from a few IP addresses, most of them declined.
Declines can still carry gateway fees, and approved tests turn into disputes later. The fixes:
- Velocity limits: caps on how many payments one IP address, card or account can make per hour or day.
- A minimum amount filter if you never sell anything for a dollar or two.
- A CAPTCHA and a cap on payment attempts at checkout, set in your cart.
If you use Authorize.Net, its Advanced Fraud Detection Suite (AFDS) handles the gateway side, and it's listed at $0 a month on Authorize.Net's pricing page. Our guide to the Authorize.Net Fraud Detection Suite gives starter velocity settings and filter actions.
Ecommerce Fraud Prevention Tools: What AVS and CVV Prove
Two checks come with almost every gateway. Both are useful for ecommerce fraud prevention, and both have limits.
- AVS (Address Verification Service) compares the billing street number and ZIP code the buyer entered with what the card-issuing bank has on file. A match means the buyer knows the cardholder's address. It doesn't mean the buyer is the cardholder, and it says nothing about the shipping address. Support for addresses outside the U.S. varies by bank, so an "unavailable" result on a foreign card isn't a red flag by itself.
- CVV (the 3- or 4-digit code on the card) shows the buyer likely had the card, or a full copy of its details. It isn't proof: stolen data often includes it. PCI DSS doesn't allow you to store the code after authorization, so never write it down or keep it in your system.
Both give you results, not decisions: your gateway settings decide whether a mismatch is declined, held or allowed. Always key a real expiration date. START charges no AVS fees.
3-D Secure and the Liability Shift
3-D Secure (Visa calls its version Visa Secure) asks the card-issuing bank to confirm the buyer during checkout. Often that happens in the background. Sometimes the buyer sees a one-time code or an app prompt.
The payoff is the liability shift. Under the Visa Core Rules (April 18, 2026 edition, section 11.7.5.3), a card-absent fraud dispute is invalid when:
- the bank confirmed the cardholder through Visa Secure with EMV 3-D Secure, and the payment was sent with electronic commerce indicator (ECI) 5 and the authentication value (CAVV), or
- the bank or Visa returned an "attempt" response and the payment was sent with ECI 6 and a CAVV (this one excludes non-reloadable prepaid cards).
In plain terms: when authentication works, a "that wasn't me" dispute can't be pushed back to you. It doesn't cover "item not received" or "not as described" disputes. Other card brands have their own 3-D Secure rules, so ask your provider what applies.
The trade-off: an extra step can lose a few buyers, and the service may carry a gateway fee (Cybersource sells it as Payer Authentication). Many stores use it only on higher-risk orders.
Visa's card-not-present interchange incentives
Visa's U.S. interchange schedule effective April 18, 2026 also lowers the rate on some online payments. On consumer credit card-not-present rates, qualifying transactions can get:
- −0.05% for payments made with an EMV token
- −0.10% for payments that qualify for Visa's Digital Commerce Authentication Program (DCAP)
- −0.15% for DCAP plus an EMV token
Visa says these need CPS qualification and are "subject to change." DCAP has its own data requirements, set in Visa's DCAP guide, so it isn't automatic with 3-D Secure. Ask your provider whether your gateway setup qualifies, and whether your statement passes the savings through. Our guide to interchange-plus pricing explains how these rates reach your statement.
Payment Fraud Prevention: What to Do When an Order Looks Wrong
Good payment fraud prevention is mostly a habit: hold the order, check it, then decide. A simple routine for a small team:
- Hold, don't ship. An authorized payment you haven't shipped is still easy to cancel.
- Check the order against the signs. Count them. One is normal. Three is a call.
- Contact the buyer using details you found, not only the ones they gave you. A real customer is usually glad you checked. A fraudster often goes quiet.
- Ask for more when the order is big. For example, a call from the phone number on the order, or shipping only to the billing address.
- Decide and write it down. Note why you shipped or cancelled. If a dispute comes later, those notes help.
For credit card fraud prevention on phone orders, ask for the card type and the name as printed. Hesitation is a signal.
After a Fraudulent Sale: Refund or Wait for the Dispute?
If you find out after the payment settles that an order was fraud, refund it to the original card and stop the shipment if you can. Waiting rarely helps:
- You lose the sale either way. A dispute adds a chargeback fee and counts against your account.
- A disputed fraud sale is hard to win without 3-D Secure or strong evidence the real cardholder made it.
Never refund to a different card or by another method, even if the buyer asks. If goods already shipped, ask the carrier about stopping delivery. Then tighten the filters that let the order through.
Friendly Fraud: When the Real Cardholder Disputes
Friendly fraud is a dispute filed by the person who really made the purchase. Sometimes it's deliberate. Often it's a family member's purchase or a charge the buyer doesn't recognize.
AVS, CVV and velocity limits won't stop it. What helps:
- A billing descriptor (the name on the card statement) that customers recognize
- Order and shipping emails, delivery tracking, and your policies in the box
- A support phone number and email on every page, so buyers reach you before their bank
- Keeping order records: customer login, IP address, device and delivery address
Those records matter. Visa's Compelling Evidence 3.0 rule makes a fraud dispute invalid when the same card was used in two earlier, undisputed transactions processed more than 120 days before the dispute, and the device or IP address plus another detail (such as login or delivery address) match. Visa expands this rule for disputes processed on or after October 24, 2026, when the earlier transactions can be at other merchants too. Your provider submits the evidence, so ask what data your gateway captures.
Our guide to chargeback prevention covers each dispute cause and how to respond.
How Fraud Affects Your Merchant Account
Each fraud dispute costs more than one sale. Visa and Mastercard watch how many fraud reports and disputes each merchant gets. Too many can mean fines, a reserve or a closed account. The current thresholds are in our guide to chargeback ratio limits.
Authorize.Net and Cybersource refer merchants to START, which finds and underwrites the merchant account and connects the gateway. If you're opening an online store, read how the ecommerce merchant account process works. If you're already seeing fraud or card testing, tell us what you sell and what you're seeing, and we'll tell you where to start.
General payments guidance, not legal advice. Visa rules are from the Visa Core Rules and Visa Product and Service Rules (April 18, 2026 edition) and Visa's U.S. interchange schedule (rates effective April 18, 2026), as of September 2026. Card network rules change twice a year, and your acquirer's agreement may add its own requirements. AFDS pricing is Authorize.Net's own published price, not START's.
Card-Not-Present Fraud FAQ
Who pays for card-not-present fraud?
Usually the merchant. When the real cardholder disputes an online, phone or mail order as fraud, the money comes back out of your merchant account, plus a chargeback fee. The main exception is a Visa payment authenticated with 3-D Secure, where Visa's rules make the fraud dispute invalid.
Does AVS stop fraud?
Not on its own. A fraudster with full stolen details passes AVS, and a real customer who moved may fail it. Use it with CVV, velocity limits and the warning signs.
Should I use 3-D Secure?
If fraud disputes are costing you, yes. Under Visa's rules, a fraud dispute on a payment authenticated with Visa Secure is invalid. Because it can add a step and a fee, many stores use it only on higher-risk orders.
Should I refund an order I think is fraud?
Yes, if you're confident it's fraud. Refund to the original card and don't ship. You lose the sale either way, and a refund made before the cardholder disputes avoids the chargeback fee and a dispute on your record. Never refund to a different card or by another method.
Seeing fraud or card testing?
Tell us what you sell and what you're seeing, and we'll tell you where to start. START has been in payments for 20+ years and has set up more than 60,000 Authorize.Net accounts.
New to this topic? Start with our Merchant Accounts overview.
