Card-not-present transactions are any card payments where the physical card isn’t read by a terminal at checkout: online orders, mobile app purchases, phone and mail orders, and stored-card recurring billing. If you accept them, you pay higher interchange fees than brick-and-mortar sellers, you absorb nearly all fraud losses because federal law caps cardholder liability at $50, and you take on compliance obligations covering data security, chargeback disputes, subscription billing, and multi-state sales tax that in-person retailers don’t face.
Everything that follows flows from one fact: without a chip read or magnetic stripe swipe, there’s no cryptographic proof the real card was used. Card networks price that uncertainty into every fee and rule.
What Counts as Card-Not-Present
A transaction is card-not-present whenever neither the cardholder nor the physical card is at your location during checkout. E-commerce is the obvious case, but the category also covers phone orders, mail orders, and any recurring charge where you’ve stored card details and bill automatically. How you collected the card number doesn’t matter. If a terminal didn’t read the chip or stripe, it’s card-not-present.
You’ll Pay More to Process the Sale
Interchange fees on remote transactions run consistently higher than card-present rates. Visa’s U.S. schedule effective October 2025 charges 0.80% plus $0.15 for a standard card-present retail debit transaction, versus 1.65% plus $0.15 for the same transaction done remotely, a gap of 0.85 percentage points.1Visa. Visa USA Interchange Reimbursement Fees Mastercard’s 2025–2026 U.S. consumer credit schedule shows a similar spread: small-ticket Core transactions start at 1.65% plus $0.02 in person and 1.95% plus $0.02 remotely.2Mastercard. Mastercard 2025-2026 US Region Interchange Programs and Rates
Those fractions compound. A business processing $500,000 a year in card-not-present sales could pay $2,500 to $4,250 more in interchange than an identical volume of in-person sales, depending on card type and network.
Who Pays When a Remote Charge Is Fraudulent
You do, almost always. Federal law caps a cardholder’s liability for unauthorized credit card use at $50, and most major issuers waive even that.3Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Without a chip read or signed receipt proving the real cardholder authorized the sale, the issuing bank sides with the customer in nearly every dispute. You lose the merchandise and the transaction amount.
Then there’s the chargeback fee itself, typically $15 to $100 per dispute regardless of outcome. Accumulate too many and your processor may put you in a monitoring program with higher per-transaction fees, mandatory reserves, or outright termination.
Not every chargeback involves a stolen card. Legitimate customers sometimes dispute charges they actually made, claiming non-delivery or non-authorization to avoid paying. Visa’s Compelling Evidence 3.0 framework lets you fight these by submitting proof the same cardholder completed at least two prior undisputed transactions along with matching data points, delivery confirmation for physical goods, or IP address, device ID, and timestamps for digital goods.4Visa. Visa Core Rules and Visa Product and Service Rules The practical lesson is to log everything. IP addresses, device fingerprints, tracking numbers, account creation records, authentication events. Merchants who don’t keep this data are defenseless when a dispute lands.
Three Verification Layers That Reduce Your Exposure
The Card Verification Value is the three-digit code on the back of Visa, Mastercard, and Discover cards, or the four-digit code on the front of American Express. Requiring it at checkout proves the buyer has the physical card in hand, not just a stolen number. PCI rules prohibit storing the CVV after authorization, so you have to collect it fresh every time.5PCI Security Standards Council. PCI Data Storage Dos and Donts
The Address Verification Service checks the billing address and zip code the buyer enters against what the issuing bank has on file. A full match isn’t a guarantee of legitimacy, but a mismatch is a strong fraud signal. Payment gateways can be configured to decline failed AVS checks automatically or flag them for review.6U.S. Payments Forum. Address Verification Service (AVS)
3D Secure, the protocol behind Visa Secure and Mastercard Identity Check, adds a real-time authentication step. The cardholder’s bank evaluates risk and either approves silently or prompts the customer to verify identity through a one-time code, biometric, or banking app. The payoff: when a transaction is authenticated through 3D Secure, fraud chargeback liability shifts from you to the issuing bank. That liability shift is the single most effective financial protection available in remote commerce. The tradeoff is checkout friction, which can hurt conversion if the challenge is poorly implemented.
PCI DSS Compliance Is Not Optional
Every merchant that accepts card payments must comply with the Payment Card Industry Data Security Standard. The current version, PCI DSS 4.0.1, became fully enforceable on March 31, 2025, replacing the earlier 3.2.1 standard.7PCI Security Standards Council. Just Published – PCI DSS v4.0.1 The core obligations most relevant to card-not-present merchants:
- Configure firewalls to protect cardholder data, and change vendor-supplied default passwords before systems go live.
- Encrypt all cardholder data transmitted over public networks. Never store the CVV or full magnetic stripe data after authorization.
- Restrict access to cardholder information to employees whose roles require it.
- Regularly test security systems and log all access to cardholder data.
Enforcement comes from the card networks, not the PCI Council itself. Fines for non-compliance start at $5,000 per month and climb to $100,000 per month for prolonged violations, scaled to transaction volume and the duration of the deficiency. A data breach while out of compliance drives exposure much higher, since networks can levy additional per-record penalties on compromised card data. Persistent non-compliance can end with the loss of your ability to accept cards at all.
How Long Customers Have to Dispute, and How Long You Keep Records
Two separate clocks govern card-not-present disputes.
Federal law sets the floor. Under the Fair Credit Billing Act, a credit cardholder must send a written dispute to their issuer within 60 days of the statement date on which the billing error first appeared.8Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors The issuer then has two billing cycles, but no more than 90 days, to investigate and resolve.9Federal Trade Commission. Using Credit Cards and Disputing Charges
Card network rules run longer. Mastercard generally gives cardholders up to 120 days from the transaction date or expected delivery date to file a dispute for fraud or cardholder disagreements. Visa and American Express use similar windows, with some reason codes extending to 180 days.10American Express. What Is a Chargeback These contractual windows govern most disputes you’ll actually see.
So retain transaction records, shipping confirmations, and authentication logs for at least 180 days after each sale. Clearing data at 60 days because the federal window closed leaves you empty-handed when the network dispute arrives four months later.
Extra Rules for Subscriptions and Recurring Billing
Recurring charges carry federal obligations on top of standard payment rules. The Restore Online Shoppers’ Confidence Act requires any merchant billing a consumer’s card on a recurring basis to clearly disclose all material terms before collecting payment information, obtain the consumer’s express informed consent to the recurring charges, and collect the account number directly from the consumer rather than through a third party.11Federal Trade Commission. Restore Online Shoppers Confidence Act
The FTC’s Click-to-Cancel rule, effective in 2025, adds a blunt requirement: canceling must be as easy as signing up. If a customer enrolled online, you have to let them cancel online. No phone calls, no chat queues, no mailing a letter. The rule also prohibits misrepresenting material facts during signup and requires that billing stop immediately once a cancellation request is submitted.12Federal Trade Commission. Federal Trade Commission Announces Final Click-to-Cancel Rule Making It Easier for Consumers to End Recurring Subscriptions and Memberships FTC enforcement in this area has been aggressive, with dark-pattern cancellation flows the clear target.
Sales Tax When You Sell Across State Lines
Before 2018, remote sellers without a physical presence in a state generally didn’t have to collect that state’s sales tax. The Supreme Court’s decision in South Dakota v. Wayfair changed that by allowing states to require tax collection from out-of-state sellers who meet an economic activity threshold.13Supreme Court of the United States. South Dakota v. Wayfair Inc.
Thresholds vary, but the most common trigger is $100,000 in annual sales delivered into the state. Some states also apply a transaction-count threshold, originally 200 transactions, though many have dropped that second trigger since 2018. A card-not-present merchant selling nationally can cross these lines faster than expected, because every online order delivered into a state counts regardless of where the business sits.
The Streamlined Sales Tax Governing Board offers a centralized registration system that lets merchants register for sales tax collection in multiple participating states through a single application, and connects qualifying businesses with certified service providers that may handle calculation, reporting, and remittance at no cost to the seller.14Streamlined Sales Tax Governing Board. Streamlined Sales Tax Home For a merchant selling into many states, that kind of centralized compliance is close to essential. Tracking thresholds and filing in each state by hand is how missed deadlines and penalties happen.