A card not present transaction is any credit or debit card payment made without the card being physically read at a terminal: online checkouts, phone orders, mail-in payments, in-app purchases, and every recurring subscription charge. When one of these transactions turns out to be fraudulent, the merchant almost always absorbs the loss through a chargeback, and your personal exposure depends on which type of card was used and how quickly you reported it. Credit cards cap your liability at $50 by federal law and usually zero in practice. Debit cards are a different story, and the timeline matters more than most people realize.
What Counts as a Card Not Present Transaction
The obvious example is buying something online. You type your card number into a checkout form, and the merchant never touches the card. But the category is broader. Ordering by phone, mailing a payment form, and tapping “buy” inside an app all qualify. The common thread is that the merchant cannot inspect the card or watch you insert a chip.
Subscriptions belong here too. When you sign up for a streaming service or a monthly box, you enter your card once and the merchant stores it. That first payment and every automatic renewal are card not present transactions, which matters because some fraud protections that apply to the initial purchase do not apply to later merchant-initiated charges.
The stakes are worth stating plainly. CNP fraud losses in the United States exceeded $10 billion in 2024, roughly three-quarters of all card payment fraud. That is why the rules described below exist.
How the Authorization Clears
When you click “pay,” the data moves through several checkpoints in about two to three seconds. The merchant’s payment gateway encrypts your card information and sends it to a payment processor. The processor routes the request through the card network to your issuing bank. Your bank checks available funds or credit, screens for fraud indicators, and sends back an approval or decline code. If approved, the merchant gets a transaction ID confirming the funds are reserved.
Declines in remote transactions usually come with a specific reason: a mistyped security code, an expired card, or an address that does not match the bank’s records. Those codes let the merchant tell you what to fix rather than leaving you guessing.
How Merchants Verify You Without the Card
Since the merchant cannot look at the card, they collect data points that add up to reasonable confidence. The card number and expiration date are the baseline. The three- or four-digit security code proves you have the physical card in hand, because that code is not stored on the magnetic stripe or in the chip.
Most merchants also run address verification, which checks the billing zip code and street number you enter against what the issuing bank has on file. A mismatch is a flag, not automatic proof of fraud. Some merchants decline on any mismatch; others accept partial matches and fold the result into a broader fraud score. No single check is definitive. Together they give the merchant a working level of trust.
3-D Secure and Who Bears the Risk
3-D Secure, branded by the networks as “Visa Secure” or “Mastercard Identity Check,” adds a real-time verification step at checkout. The current version, 3DS2, quietly collects device type, browser fingerprint, purchase history, and dozens of other signals, and runs them through a risk engine. If nothing looks unusual, the transaction goes through without any extra prompt. If something looks off, you are asked to verify with a one-time passcode, a fingerprint, or facial recognition on your phone.
The reason merchants push 3-D Secure is not only fraud prevention. When a transaction successfully clears 3DS authentication, fraud liability shifts from the merchant to the card issuer. That reverses the default rule for CNP transactions. The shift applies across Visa, Mastercard, and American Express, but only to the initial customer-authenticated purchase. It does not cover later merchant-initiated charges like automatic subscription renewals, because you are not actively verifying anything for those.
Digital wallets such as Apple Pay and Google Pay produce a similar effect. Paying through a wallet uses a device-specific token instead of your real card number, and your identity is confirmed by biometric authentication on your phone. Successfully authenticated wallet transactions shift fraud liability to the issuer the same way 3DS does. Again, that shift covers the purchase you actively authorize, not subsequent recurring charges.
Your Liability if a Credit Card Is Used Fraudulently
Federal law caps your personal liability for unauthorized credit card use at $50, and that ceiling rarely bites in practice.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card The statute only imposes the $50 if the issuer gave you notice of your potential liability, provided a way to report loss or theft, and included a method to identify authorized users. Report a stolen card number before any fraudulent charges post, and your liability is zero. Regulation Z mirrors the $50 ceiling and lets any state law or card agreement with lower liability take precedence.2eCFR. 12 CFR 1026.12 – Special Credit Card Provisions
Visa and Mastercard go further than federal law requires. Visa’s zero-liability policy covers unauthorized transactions on both credit and debit cards, online or offline, as long as you took reasonable care of the card and reported the problem promptly, and it requires the issuer to replace stolen funds within five business days of notification.3Visa. Visa Zero Liability Policy Mastercard’s version is nearly identical and covers in-store, phone, and online purchases on both credit and debit.4Mastercard. Mastercard Zero Liability Protection Neither policy covers certain commercial cards or unregistered prepaid cards like gift cards. Because network policies are voluntary programs that can change, the federal statutes remain the backstop.
Your Liability if a Debit Card Is Used Fraudulently
This is where people get hurt. Debit card protections under the Electronic Fund Transfer Act are weaker than credit card protections, and your liability is a step function tied to when you report.5Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report within 2 business days of learning about the theft, and your liability caps at $50.
- Report between 2 and 60 days after your statement is sent, and your liability jumps to $500.
- Report after 60 days, and there is no cap at all. You can be responsible for the entire amount stolen.
Those timelines are unforgiving. If a thief runs your debit number through online purchases and you miss it for two months, the bank has no legal obligation to reimburse losses that occurred after the 60-day window.6eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers There is a second problem: the money is already out of your checking account while the investigation runs. With a credit card, disputed charges do not draw down your cash. With a debit card, they do. For online purchases, this is the practical case for using a credit card.
The core consumer-protection framework sits in the EFTA at 15 U.S.C. § 1693 for debit and electronic transfers,7Office of the Law Revision Counsel. 15 USC 1693 – Congressional Findings and Declaration of Purpose and in the Fair Credit Billing Act at 15 U.S.C. § 1666 for credit card billing errors and disputes.8Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
Why the Merchant Usually Pays, Not the Bank
In CNP fraud, the merchant almost always eats the loss. That is the opposite of what happens with in-person EMV chip transactions, where liability can shift to the issuer. The logic is straightforward: the merchant chose to accept a payment without physically verifying the card, so the merchant assumes the risk that the buyer was not who they claimed to be.
The mechanism is the chargeback. When you dispute a charge, your bank reverses the transaction and pulls the funds back from the merchant. The merchant can accept the loss or fight it with evidence: proof of delivery to the billing address, IP address logs matching your location, records of prior successful purchases, communication history. Mastercard requires merchants to respond through its dispute system within 45 days of the initial chargeback and 30 days for a pre-arbitration filing.9Mastercard. Chargeback Guide Miss either window and the merchant loses automatically. Most payment processors impose tighter internal deadlines of five to ten days.
On top of the reversed sale, processors charge a dispute fee for every chargeback, typically ranging from $15 to over $100 depending on the processor and the merchant’s history. That is why online merchants invest so heavily in address verification, 3-D Secure, and fraud screening: prevention costs less than chargebacks.
How Merchants Are Required to Protect Your Data
Any business that handles card data is bound by the Payment Card Industry Data Security Standard. The current version, PCI DSS v4.0.1, took effect after v4.0 was retired at the end of 2024, with new requirements becoming mandatory as of March 31, 2025.10PCI Security Standards Council. Just Published: PCI DSS v4.0.1 Two techniques do most of the work. Encryption scrambles card data in transit so an interceptor sees meaningless characters. Tokenization replaces stored card numbers with random strings that have no value outside the merchant’s own system, so a database breach yields tokens rather than usable card numbers.11PCI Security Standards Council. PCI DSS Quick Reference Guide PCI DSS governs the merchant’s obligations, not your personal liability, but the security posture it enforces is why most CNP fraud comes from stolen credentials rather than mass breaches of card databases.