Card Not Present Fraud: How CNP Attacks Work and How to Prevent Them

TL;DR: CNP fraud browser session signal capture

• The blind spot: By the time a CNP transaction reaches the gateway, most of the signal that would expose the fraud is already gone. The gateway sees a card number, an expiry, a CVV, and a user agent string. That's the entire trust surface.
• What cside captures: cside captures the browser-layer signals that separate a returning customer from an attacker on stolen data (stable device fingerprint, session behavior, VPN and proxy absence), and the same capture later becomes CE 3.0 evidence in the chargeback fight.
• Pick your layer: The 2024 Nilson Report put global card fraud losses at $33.83 billion with CNP now the majority. Pick your control layer: 3DS shifts liability but erodes conversion, browser-layer signals add no friction on transactions that 3DS already cleared.

Short on time? See cside's chargeback-evidence tooling. It covers everything below in one deployment.

The card is not in the store, so the merchant has no PIN, no chip, and no signature. Everything the acquirer sees is a card number, an expiry date, a CVV, and whatever metadata the checkout collects. That is the entire trust surface for card not present fraud (CNP), and it is where most e-commerce losses happen.

What card not present fraud is

CNP fraud is any fraudulent transaction where the physical card is not presented at the point of sale. That covers online checkouts, phone orders, mail orders, and in-app purchases. The attacker has enough card data to complete the transaction and enough control of the session to make it look legitimate to the gateway.

The 2024 Nilson Report put global card fraud losses at $33.83 billion. The share attributable to CNP has been climbing every year since chip-and-PIN made physical fraud harder, and it now accounts for the majority of loss volume in most major markets.

Where the fraud comes from

CNP fraud has four common entry points, and most merchants see all four in some ratio:

• Stolen card data used at checkout after a data breach, phishing campaign, or dark-web purchase
• Account takeover where the attacker logs into a legitimate customer account and uses the card on file
• Enumeration or BIN attacks where the attacker tests card numbers and uses the approved ones (see our BIN attack guide)
• Friendly fraud where a legitimate customer disputes a valid transaction they actually made

The controls that stop each entry point are different. A merchant that treats CNP fraud as a single problem is optimizing against averages and losing on the specifics.

What the payment gateway cannot see

By the time a CNP transaction reaches your gateway, most of the signal that would expose the fraud is gone. The gateway sees:

• Card number, expiry, CVV
• Billing address (if AVS is used)
• IP address
• Basic device metadata from the browser user agent

That data is enough to run AVS, CVV match, and 3-D Secure, but it is not enough to distinguish a real returning customer from an attacker using stolen data on a fresh device. The signals that separate the two live in the browser session that came before the transaction submission.

What the browser sees

Every CNP transaction starts as a browser session. Before the customer hits Pay, the browser has already produced:

• A device fingerprint that combines dozens of properties into a stable identifier
• Behavioral signals: cursor movement, typing rhythm, scroll depth, form field interaction sequence
• Session context: referral source, prior pages visited, time on site, cart-edit history
• Script activity: every third-party script that loaded and what data it touched

A returning customer produces a device fingerprint that matches a prior order, behavioral patterns consistent with a human, and session context that fits normal browsing. A CNP fraud attempt usually produces at least one mismatch, and often several.

The controls that actually reduce CNP loss

3-D Secure shifts liability but adds friction that erodes conversion. Device fingerprinting and behavioral scoring add zero friction and give you a signal on the transactions that 3-D Secure clears. The Mastercard FPT rollout has pushed the ecosystem in this direction.

Where cside fits

cside sits at the browser layer on every checkout session, before the transaction reaches the gateway. The device fingerprint identifies returning legitimate customers and flags fresh devices attempting to use known card data. Behavioral scoring separates humans from scripted attacks. Script activity monitoring catches the Magecart-style skimmers that steal the card data attackers use later.

If a disputed transaction ends up in chargeback proceedings, the same device fingerprint becomes compelling evidence that the cardholder was on the device at time of purchase.

A short CNP audit for your checkout

Three checks tell you where the leak is:

1. Chargeback reason code distribution. If most of your CNP chargebacks are reason code 10.4 (Other Fraud) or 4863 (Cardholder Does Not Recognize), the fraud is happening upstream, likely stolen card data or ATO. If most are 10.1, 10.2, 10.3 (EMV/authorization or non-receipt), the issue is likely process or delivery.
2. Session data on disputed transactions. For every dispute in the last 90 days, ask whether you can produce the device fingerprint, IP, and session behavior of that transaction. If the answer is no, you cannot defend the dispute and cannot separate friendly fraud from real fraud.
3. Time between checkout and complaint. Real customers who dispute usually complain within days. Friendly fraud tends to appear 30 to 120 days after the transaction. Distribution of the delay tells you what mix you have.

Those three numbers give you a fraud profile that is more useful than any aggregated fraud score.