Stop Card Not Present Fraud Before It Costs You

The order came in over the phone. Friendly customer, big ticket, no haggling about price. You keyed the card in, it approved on the first try, and you shipped it the next morning. Six weeks later your processor quietly pulls that money back out of your bank account, tacks on a fee, and hands you a dispute you have almost no chance of winning. That is card not present fraud, and it is the loss most small business owners never see coming — because at the time, nothing about the sale felt wrong.

Here is what makes it so frustrating. When a customer taps or dips a chip card at your counter, the card itself proves the customer was standing there. When the card number arrives over a phone line, a website form, or an emailed invoice, you have no such proof. And in the card networks’ rulebook, no proof means the loss lands on you. Not the bank. Not the card brand. You.

The good news is that this is a solvable problem, and it does not require a fraud department or an enterprise budget. It requires knowing which checks to turn on, which orders deserve a second look, and which hardware and software choices quietly do the work for you. Let’s walk through it.

What Card Not Present Fraud Actually Looks Like

A card-not-present transaction is any sale where the physical card never touches your equipment. That covers far more of your business than you might think: phone orders, online checkout, emailed invoices, keyed-in payments at the counter when a chip won’t read, deposits taken over text, and recurring subscriptions billed to a card on file.

Every one of those is convenient. Every one of those also strips away the single strongest piece of evidence you could have in a dispute. Fraud follows the path of least resistance, and this is it.

In practice, card not present fraud shows up in three recognizable patterns.

Card testing. Someone runs a batch of small transactions — a few dollars each, often in rapid succession — to find out which stolen numbers from a data dump are still live. Your business is not the target; it is the test lab. The tell is a burst of small authorizations, many of them declined, from unfamiliar addresses in a short window.

The too-good order. A large order arrives from a new customer who is unusually relaxed about price, wants overnight shipping, and asks you to send it to an address that does not match the billing address on the card. Rush shipping matters to a fraudster because the goods need to be gone before the real cardholder notices the charge.

First-party misuse. The cardholder genuinely made the purchase, then disputes it anyway — sometimes because a family member used the card, sometimes because they simply forgot, and sometimes because it is easier than asking you for a refund. This is the hardest category to fight, and for many small businesses it is the most common.

Recognizing which pattern you are facing changes what you do about it. Card testing is a systems problem. The too-good order is a verification problem. First-party misuse is a documentation problem. Owners who lump all three together under “we got hit by card not present fraud” tend to overcorrect in one direction — usually by making legitimate customers jump through hoops — while leaving the actual hole wide open.

Why Merchants Eat the Loss

The numbers here are not a matter of opinion. According to research published by the Federal Reserve Bank of Kansas City, card-not-present transactions carried a gross fraud loss rate of 41.6 basis points in 2023 — roughly three times the 14.2 basis points on card-present transactions over dual-message networks, and about eight times the 5.1 basis points on single-message networks.

The more important number for your business is who pays. Merchants absorbed 49.9% of all debit card fraud losses in 2023, up from 46.9% two years earlier. Cardholders now carry 21.8% of the losses, up from under 2% in 2011. Both of those shares grew, and the issuers’ share shrank. The trend line is unmistakable: the risk is being pushed steadily down the chain, and the bottom of that chain is the small business owner.

The direct loss is only part of the damage. When a card not present fraud dispute lands, you typically lose the merchandise, the shipping cost, the transaction amount, and a chargeback fee on top — often $15 to $40 per case. Then you lose an hour or two assembling a response. If disputes stack up, your processor may add a rolling reserve or, in a bad enough case, close the account. Understanding why customers file chargebacks is the first step toward keeping that from ever becoming your problem.

The Rules Behind Card Not Present Fraud Liability

When the U.S. finished migrating to chip cards, counterfeit fraud at the counter got significantly harder to pull off. Fraud did not disappear; it relocated. It moved to exactly the channels where a chip cannot help — phone, web, and keyed entry. The chip liability shift solved a card-present problem and, in doing so, made card not present fraud the main event.

Two rules matter most for how a dispute plays out.

The burden of proof is yours. For a card-present sale, the chip read is the evidence. For a card-not-present sale, you must produce the evidence yourself: address verification results, the security code check, proof of delivery to the verified address, signed authorization for the amount, and a record of prior good transactions with the same customer. Missing any of these makes a rebuttal significantly weaker.

Chargeback ratios are monitored. The card networks track your disputes as a percentage of your transactions, and crossing the threshold puts you into a monitoring program with monthly fees and remediation deadlines. A single bad month rarely triggers it. A pattern will. This is one more reason to fix the intake process rather than fight cases one at a time — the practical steps in our guide to preventing chargebacks apply directly here.

There is a third rule worth knowing, and it works in your favor. When you use the network’s own verification tools correctly, the liability for certain fraudulent disputes moves off your books and back onto the card issuer. That is not a loophole; it is how the system is designed to work. The catch is that the protection only applies if the checks actually ran, and on a lot of small business accounts, they simply never got switched on.

The upshot: the cheapest dispute is the one that never happens, and the second cheapest is the one where you already have the documentation sitting in a folder.

Five Tools That Push Card Not Present Fraud Back

None of these are exotic. Most are already available on the equipment and gateway you have — they are just switched off, or nobody ever explained what the response codes mean.

1. Address Verification Service (AVS). AVS compares the billing street number and ZIP the customer gives you against what the issuing bank has on file. It costs pennies per transaction and it is the single fastest filter for a stolen card number, because a fraudster with a card number very often does not have the cardholder’s billing address. Set your rules so a full mismatch does not simply get flagged — get it declined.

2. The security code (CVV/CVC). The three or four digits on the card are never allowed to be stored, which means a stolen database dump usually doesn’t include them. Always ask for it, always require a match, and never write it down on the order slip.

3. Authentication for online orders. For e-commerce, the modern authentication protocols let the issuing bank verify the shopper before the sale completes, and when it is used correctly, liability for fraudulent chargebacks shifts back to the issuer. That is the whole game: pass the risk to the party that is better equipped to judge it. If your store runs through a payment gateway, this is a configuration conversation, not a rebuild.

4. Tokenization and card on file. Replacing stored card numbers with tokens means a breach of your systems yields nothing usable, and it makes repeat purchases from known-good customers safer and smoother. Our explainer on credit card tokenization covers how it works under the hood.

5. Velocity limits and manual review triggers. Set a rule that stops the same card from running more than a few times in a few minutes, and a rule that routes any order over a dollar amount you choose to a human. Card testing dies instantly against velocity limits, and the too-good order rarely survives a two-minute phone call to the number on the customer’s account.

A quick reality check on friction, because this is where owners get nervous: none of these five steps are visible to an honest customer. A shopper who owns the card knows their own ZIP code and can read the three digits on the back without thinking about it. The only people inconvenienced by AVS and security-code matching are the ones holding a card number they should not have.

Turn on all five and you have removed most of your exposure. A virtual terminal with these checks properly configured is a completely different risk profile from one where every keyed sale sails through unchecked.

A Practical Playbook by Business Type

The right setup depends on how the money actually reaches you.

Retail shops taking phone and social orders

If a chip won’t read and you key the sale in, you have created a card-not-present transaction at your own counter — often at a higher processing rate, too. A well-configured countertop setup like the Clover Mini can require AVS and CVV on keyed entry, so the protection is automatic rather than dependent on someone remembering. For orders coming in through social messages, take payment through a secure payment link rather than accepting a card number typed into a chat window. Retailers can see the broader options on our retail payment processing page.

Service businesses that invoice

Contractors, consultants, and repair shops carry a particular version of this risk: large tickets, remote customers, and long gaps between the work and the payment. Send a real invoice with a secure pay link instead of collecting card numbers by phone or email — online invoicing gives you a timestamped record of who paid what and when, which is exactly the evidence a dispute response needs.

Mobile and on-site businesses

If you take payments away from a fixed counter, a handheld like the Clover Flex lets you dip or tap the real card on site instead of writing the number down to key in later. Every sale you convert from card-not-present to card-present is a sale you have removed from this category entirely — and it usually processes at a better rate as a bonus. Browsing the full range of POS devices for small businesses is a good place to start.

Anyone billing a card on file

Recurring charges generate disputes for a boring reason: the customer forgot they signed up. Send a short reminder before each charge, keep the signed authorization, and put a recognizable business name on the billing descriptor. If your statement descriptor reads like a holding company nobody has heard of, you are manufacturing your own card not present fraud claims. Most first-party disputes are prevented by the customer simply recognizing the line on their statement.

Whatever your model, the cost side matters too. If processing fees are a pressure point, Zero Fee Processing can offset them without touching your fraud controls, and our merchant services FAQs answer the questions owners ask most often.

The Bottom Line

Card not present fraud is not a sign that you did something careless. It is the predictable result of a payment system that shifted risk toward merchants while the convenient channels — phone, web, invoice, text — grew into a bigger share of everyone’s revenue. Merchants now absorb roughly half of card fraud losses, and no small business gets a vote in that.

What you do get is control over your own intake. Require AVS and the security code. Set velocity limits. Authenticate online orders. Tokenize anything you store. Flag the orders that do not smell right and make one phone call before you ship. That combination knocks out the large majority of card not present fraud attempts, and it costs you far less than a single bad month of disputes.

VMS has been helping small businesses in exactly this spot since 1998 — reviewing how payments actually come in the door, turning on the protections that should already be on, and matching the right equipment to how you really sell. If you are not certain what your current setup is checking, that is worth an honest look. Our support team will walk your statement and your workflow with you, tell you plainly where the exposure is, and fix it.