Card-not-present is every checkout that never sees plastic - number, expiry, CVV, an address typed into a form - and its entire war is fought against AVS, 3-D Secure and velocity scoring in about eight seconds. Component anatomy, checkout environments, fulfillment routing and the chargeback clock: the full CNP map is hidden below.
ROUTE MAP (PLAIN ENGLISH)
A card-not-present transaction is any payment card transaction executed without the physical card at a merchant - e-commerce checkout, phone order, subscription charge. The merchant receives a data bundle instead of a piece of plastic: primary account number, expiry, CVV, cardholder name, billing address, and whatever device and network telemetry the checkout page can observe. Every CNP cashout is the same contest: push a payment bundle through the merchant's verification stack, get goods or digital value on the other side, and finish before the reversal window opens.
The verification stack layers three defenses. Address Verification Service compares the submitted billing address digits against what the issuing bank has on file - partial and full match modes mean different pass thresholds. Card security codes verify the CVV was present on the physical card at issuance, though a CVV in compromised data has long since been captured alongside everything else. And 3-D Secure - the protocol behind Verified by Visa and Mastercard SecureCode - shifts liability and often the decision to the issuing bank via a challenge step: OTP to the registered phone or an issuer-side frictionless score. Merchants enable 3DS selectively by risk, and the checkout path without 3DS is where data bundles still clear.
Merchants also score the session independent of the card: device fingerprint, IP reputation, proxy classification, cart composition, account age at the store, shipping-to-billing relationship. A first-time customer with a $2,000 cart shipping to a freight-forwarder address scores the same as it always has - badly. The successful path manipulates context as carefully as it manipulates credentials: familiar device signals, plausible carts, addresses that survive the shipping department's pattern matching.
The cashout is fulfillment. Digital delivery finishes inside the transaction's own minute - game currency, gift cards, license keys shipped to email. Physical goods need routing: reshippers, receiving addresses, and timing against the chargeback window that opens the moment the cardholder sees their statement. The clock between merchant payout and network reversal is the entire runway of this route.
STEP 1 - THE DATA BUNDLE AND WHAT CLEARS
STEP 2 - THE CHECKOUT ENVIRONMENT
STEP 3 - AVS, 3DS, AND THE DECLINE LADDER
STEP 4 - FULFILLMENT AND ROUTING
STEP 5 - THE CHARGEBACK CLOCK
WORKED EXAMPLE - ONE $640 CHECKOUT
Wednesday, 7:42 PM: residential-class IP in the cardholder's metro, maintained browser profile with prior store history, cart of $640 across three items - mid-range electronics plus a cable, the composition of someone replacing a setup. Billing ZIP matches the card's file; AVS full pass; 3DS not triggered at this merchant's amount threshold. Order placed as a guest on a two-year-old account with one prior delivered purchase. Merchant's risk score clears at automated speed; label prints twenty minutes later. Tracking uploads at 9 PM. Goods reach the receiving address Friday noon; the electronics sell face-to-face Saturday for $470 cash - sixty-two days of runway remaining on the clock. Statement cycle hits the holder's desk the following week; the dispute window nominally allows filing through roughly four months from transaction date, but the position converted in five days. The tracking number on file fights whatever comes next on the merchant's side; the cash on the operator's side is already past the point where any outcome reverses it.
WORKING SEQUENCE
QUICK ANSWERS
RELATED
A card-not-present transaction is any payment card transaction executed without the physical card at a merchant - e-commerce checkout, phone order, subscription charge. The merchant receives a data bundle instead of a piece of plastic: primary account number, expiry, CVV, cardholder name, billing address, and whatever device and network telemetry the checkout page can observe. Every CNP cashout is the same contest: push a payment bundle through the merchant's verification stack, get goods or digital value on the other side, and finish before the reversal window opens.
The verification stack layers three defenses. Address Verification Service compares the submitted billing address digits against what the issuing bank has on file - partial and full match modes mean different pass thresholds. Card security codes verify the CVV was present on the physical card at issuance, though a CVV in compromised data has long since been captured alongside everything else. And 3-D Secure - the protocol behind Verified by Visa and Mastercard SecureCode - shifts liability and often the decision to the issuing bank via a challenge step: OTP to the registered phone or an issuer-side frictionless score. Merchants enable 3DS selectively by risk, and the checkout path without 3DS is where data bundles still clear.
Merchants also score the session independent of the card: device fingerprint, IP reputation, proxy classification, cart composition, account age at the store, shipping-to-billing relationship. A first-time customer with a $2,000 cart shipping to a freight-forwarder address scores the same as it always has - badly. The successful path manipulates context as carefully as it manipulates credentials: familiar device signals, plausible carts, addresses that survive the shipping department's pattern matching.
The cashout is fulfillment. Digital delivery finishes inside the transaction's own minute - game currency, gift cards, license keys shipped to email. Physical goods need routing: reshippers, receiving addresses, and timing against the chargeback window that opens the moment the cardholder sees their statement. The clock between merchant payout and network reversal is the entire runway of this route.
STEP 1 - THE DATA BUNDLE AND WHAT CLEARS
- Core fields: number, expiry, CVV, name. Bare bundles clear only where the merchant verifies nothing - increasingly rare, and those merchants are also the ones running no fraud tools worth surviving.
- AVS alignment: billing address matching the issuer's records on at least ZIP code - full address match where the merchant requires it. Mismatched AVS is an automatic decline at most American gateways regardless of everything else being perfect.
- Holder profile extras: date of birth, phone, email - the fields stores ask for account creation and where issuer phone lookup succeeds. Consistent phone-to-cardholder lookup keeps account creation from tripping the store's own verification.
- 3DS posture: know which merchants enforce it per-card, per-BIN, or per-amount. Challenged flows require live phone control of the holder's registered number or an issuer-side frictionless pass - without either, the checkout dies at the challenge.
- BIN intelligence: the card's issuer and product type shape approval odds - certain BINs run looser fraud scoring, certain prepaid products skip address verification entirely, and knowing which is which before checkout replaces hope with probability.
STEP 2 - THE CHECKOUT ENVIRONMENT
- Device fingerprint: browsers carry canvas, font, and hardware signatures - a fingerprint that has checkout history at the merchant behaves like a returning customer, one that looks freshly assembled behaves like exactly that. Profile hygiene means one environment per identity story, maintained.
- Network: datacenter IPs are classified and discounted instantly - residential-class addresses from the target's country match the billing address's geography. IP and billing ZIP disagreeing by two thousand miles is a score the model doesn't need training to catch.
- Account history at the store: guest checkout where possible; where accounts matter, an account with prior ordinary purchases outranks a brand-new one. Store loyalty is itself a risk signal merchants already trust.
- Cart composition: natural carts have variety, mid-range totals, and ordinary categories. High-risk categories (gift cards, electronics, anything instantly liquid) concentrate review attention - their share of the cart should match what a real buyer's would.
- Order cadence: one order per session, sessions spaced, no stacking. Velocity scoring counts orders per device, per address, per card within hours - the stack pattern triggers holds before fulfillment ever ships.
STEP 3 - AVS, 3DS, AND THE DECLINE LADDER
- Decline reading: every refusal has a code - do not retry the identical bundle against the same gateway; retrying burns the merchant relationship and bumps velocity counters. A soft decline (try again, issuer busy) differs from hard (stolen, closed, invalid) and only soft ones ever see a second attempt.
- 3DS challenge reality: OTP challenges land on the holder's registered phone - without number control, the flow stalls. Where issuers score frictionlessly, some transactions pass without prompt; where merchants exempt low-value carts, thresholds decide before the issuer ever sees it.
- Liability shift: a completed 3DS authentication moves fraud liability to the issuer, which means merchants who enforce it also stop fighting disputes over those orders - 3DS-active merchants have both better security and less chargeback appetite to dodge.
- Amount thresholds: many merchants escalate verification above round numbers - keeping checkout totals in plausible retail ranges defers the escalation to where the bundle already passes.
- Retry discipline across merchants, not across gateways: same merchant, same card, same day is a pattern; different merchants spaced apart is just shopping. The network-level velocity signals follow the card, the store-level ones follow the store.
STEP 4 - FULFILLMENT AND ROUTING
- Digital first: instant-liquidation categories - game currency, gift cards, digital store credit - finish delivery inside the transaction window and convert downstream without shipping addresses at all. The trade: digital categories are also the most tightly scored, so cart context has to carry them.
- Physical routing: delivery to receiving addresses under third-party control - freight services, reshippers, or cooperative receivers - decouples the cardholder's address from the goods' final position. The shipping address still has to survive merchant pattern checks: residential-looking, in-region, no freight-forwarder flags.
- Shipping-billing coherence: orders where the merchant sees shipping address ≈ billing geography ship faster; flagged mismatches enter manual review where a human opens the address in a search box. Review is where orders die slowly.
- Tracking discipline: uploads of tracking numbers close disputes - a delivered order with proof fights a chargeback far better than a vanished one. Fulfillment quality IS chargeback defense on the merchant side; from the buyer's side it just proves the pipeline works.
- Cashout timing: goods convert to cash through resale inside the same window the chargeback stays open - the resale speed versus dispute clock ratio decides whether the position clears or unwinds. Slow-moving inventory is exposure, not asset.
STEP 5 - THE CHARGEBACK CLOCK
- The network's fraud dispute window runs from the transaction date - commonly up to one hundred twenty days for card-network fraud claims under current rules, with issuer filing deadlines compressing it in practice. Delivery, resale, and conversion all fit inside it or the position reverses.
- Reason codes: fraud claims (unauthorized transaction) versus service disputes (not received, not as described) fight different battles - unauthorized kills fastest and hardest; service disputes reward merchants who uploaded tracking.
- Alert networks: card-network and third-party alert services notify the merchant of an impending dispute before filing - orders flagged by alerts can be cancelled or flagged for review; operators see the same alerts as a countdown signal on affected orders.
- Retrieval requests: the pre-dispute inquiry - the issuer asks the merchant for documentation. Responded-to retrievals become disputes anyway; unanswered ones default. Either way they mark which transactions the issuer is already looking at.
- Loss economics: a lost dispute refunds the transaction, often assesses a fee, counts toward chargeback ratio thresholds - above network limits (commonly around one percent), merchants face monitoring programs. Every reversal costs twice: once to the position, once to the ratio.
WORKED EXAMPLE - ONE $640 CHECKOUT
Wednesday, 7:42 PM: residential-class IP in the cardholder's metro, maintained browser profile with prior store history, cart of $640 across three items - mid-range electronics plus a cable, the composition of someone replacing a setup. Billing ZIP matches the card's file; AVS full pass; 3DS not triggered at this merchant's amount threshold. Order placed as a guest on a two-year-old account with one prior delivered purchase. Merchant's risk score clears at automated speed; label prints twenty minutes later. Tracking uploads at 9 PM. Goods reach the receiving address Friday noon; the electronics sell face-to-face Saturday for $470 cash - sixty-two days of runway remaining on the clock. Statement cycle hits the holder's desk the following week; the dispute window nominally allows filing through roughly four months from transaction date, but the position converted in five days. The tracking number on file fights whatever comes next on the merchant's side; the cash on the operator's side is already past the point where any outcome reverses it.
WORKING SEQUENCE
Code:
bundle: number+exp+cvv+name + AVS-aligned address + holder extras -> environment: residential IP matching geography, maintained fingerprint, plausible cart under escalation thresholds -> verify: decline codes read (hard=walk, soft=one retry), 3DS feasibility checked pre-checkout -> fulfill: digital instant or physical to clean receiving address, tracking uploaded same day -> convert: resale completed deep inside 120-day window -> monitor: alerts/retrievals watched as countdown, ratio-aware merchants preferredQUICK ANSWERS
- What does CNP mean? Card-not-present - any payment card transaction executed without the physical card at the merchant: e-commerce checkout, phone orders, recurring charges. The verification stack (AVS, CVV, 3-D Secure, device scoring) replaces the card reader.
- What is AVS in carding terms? Address Verification Service - the gateway compares submitted billing address digits against the issuer's records, usually ZIP first, full street address on strict settings. AVS mismatch is an automatic decline at most American merchants.
- How long does a chargeback take on an online order? Card-network fraud disputes can be filed up to one hundred twenty days from the transaction under current rules, with issuer deadlines often tighter - service disputes follow similar outer limits. The window opens when the statement hits and never extends.
- Does 3-D Secure block card-not-present fraud? It shifts the decision - and the liability - to the issuing bank, which either passes the transaction frictionlessly, challenges with an OTP to the holder's phone, or declines. Merchants enforcing 3DS both block more and fight fewer disputes.
- What is the difference between card-present and card-not-present? Card-present means the physical card and its chip or magstripe are at the terminal - hardest to dispute under network rules. Card-not-present is data-only - easiest to attempt, most heavily scored, and cheapest for cardholders to claim unauthorized.
RELATED