What Counts as a Card-Not-Present Transaction
A card-not-present (CNP) transaction is any card payment where your terminal never reads the physical card. The customer types or reads you the card details, or you charge a card you already have on file. Because nothing is tapped, dipped or swiped, you pay more: on Visa's published U.S. rates, a Traditional Rewards credit sale goes from 1.65% + $0.10 to 2.04% + $0.10 in interchange.
Common CNP sales:
- Online orders. Your website checkout or booking form, the everyday case for ecommerce businesses.
- Phone and mail orders (MOTO). You enter the card into a virtual terminal.
- Invoices and payment links. The customer pays on a hosted page.
- Recurring billing. Memberships and subscriptions, covered in our recurring billing guide.
- Card-on-file and in-app charges. A saved card charged later, such as a no-show fee at a hotel.
The PCI Security Standards Council uses the same examples: e-commerce and mail order/telephone order. If your business accepts credit cards without a machine, nearly all of your volume is card-not-present.
Card Present vs Card Not Present
A card-present transaction is the opposite. The card, or a phone or watch carrying it, is at your terminal, which reads it by chip, contactless tap or magnetic stripe. The chip creates a one-time code for each payment, which shows the card is real. A CNP sale has nothing like that, so you lean on CVV2, address checks and authentication instead.
| Card present | Card not present | |
| How the card is read | Chip, tap, or swipe at a terminal | Card details typed in, or a stored card or token |
| What proves the card is real | The chip creates a one-time code for each payment | Nothing physical: you rely on CVV2, address checks, and authentication |
| Interchange cost | Generally lower | Generally higher (see Visa's rates below) |
| Main fraud risk | Counterfeit cards, which chip technology is designed to reduce | Stolen card numbers |
| Who usually eats fraud losses | Depends on chip support (EMV liability shift) | Typically the merchant, unless the transaction was authenticated (3-D Secure) |
Is a Keyed-In Sale at the Counter Card-Not-Present?
When the chip won't read and you type the number in, the sale isn't labeled card-not-present. But it can cost the same. In Visa's April 2026 debit tables, "CPS/Retail Key Entry" sits in the card-present section, yet exempt debit keyed that way costs 1.65% + $0.15. That matches Visa's CPS/Card Not Present debit rate and is roughly double the 0.80% + $0.15 for exempt debit dipped or tapped at retail. On a $100 exempt debit sale, that's $0.95 in interchange dipped and $1.80 keyed.
Visa's credit tables don't say how a keyed credit sale is categorized, so ask your processor. And key in a number only when a chip or tap truly fails.
Why Card-Not-Present Transactions Cost More
Every card sale carries interchange, the fee the card networks set and your processor passes to the bank that issued the card (see our payments glossary). The networks price it by risk, and nobody can confirm the card is real on a CNP sale, so CNP categories generally carry higher rates.
Visa's U.S. rates effective April 18, 2026:
| Visa card | Card present | Card not present |
| Traditional Rewards | 1.65% + $0.10 | 2.04% + $0.10 |
| Signature Preferred | 2.10% + $0.10 | 2.50% + $0.10 |
| Infinite (spend qualified) | 2.30% + $0.10 | 2.60% + $0.10 |
| Exempt debit | 0.80% + $0.15 | 1.65% + $0.15 |
On a $200 Traditional Rewards sale, that's $3.40 in interchange with the card present and $4.18 without it.
Worked example 1: $50,000 a month, card present vs card not present
A fictional shop runs $50,000 a month on Visa Traditional Rewards credit cards, in 500 sales averaging $100. On Visa's published rates effective April 18, 2026:
| Interchange | Card present (1.65% + $0.10) | Card not present (2.04% + $0.10) |
| Percentage part, on $50,000 | $825.00 | $1,020.00 |
| Per-item part, 500 sales at $0.10 | $50.00 | $50.00 |
| Total for the month | $875.00 | $1,070.00 |
The gap is $195 a month, or $2,340 a year. The shortcut: 2.04% minus 1.65% is 0.39%, and 0.39% of $50,000 is $195. The $0.10 per-item fee is the same on both sides, so it cancels out at any ticket size.
This is interchange only, on Visa's published rates. It leaves out your processor's markup and assumes every sale is a Traditional Rewards card. It also assumes the shop is too big for Visa's Small Merchant program, which is open to merchants with no more than $280,000 a year in Visa consumer credit sales (qualification rules apply). There, a Traditional Rewards card costs 1.43% + $0.10 card present and 1.73% + $0.10 card not present, a 0.30% gap instead of 0.39%.
When Card-Present and CNP Rates Are the Same
Regulated debit is the exception. Debit cards covered by the Federal Reserve's Regulation II limits are listed as "regulated" in Visa's schedule, at the same rate (0.05% + $0.21, plus $0.01 for issuers certified for fraud-prevention standards) whether the card is present or not.
Visa also runs separate programs for restaurants, travel, utilities, recurring bill payments and more, some with lower CNP rates. Your rates depend on your merchant category code, card mix and how you submit transactions. Mastercard, Discover and American Express price separately; we haven't quoted their rates here.
On a flat or tiered plan, your processor may also bill CNP and keyed sales at a separate, higher "non-qualified" tier. That's the processor's decision, not a network rule. Interchange-plus pricing shows the real interchange on each sale, and the processing fee calculator estimates the difference.
Who Pays for Card-Not-Present Fraud?
The chip liability shift covers counterfeit cards in the store
Visa's U.S. liability shift for counterfeit fraud took effect in October 2015. Under it, in Visa's words, "the cost of counterfeit fraud is the responsibility of the party – either the merchant or the issuer – that has not implemented chip technology." Swipe a chip card on a terminal that can't read chips, and a counterfeit chargeback can land on you. None of this protects a CNP sale.
3-D Secure: Visa Secure and Mastercard Identity Check
On CNP sales, EMV 3-D Secure plays the chip's role. The issuer confirms the shopper's identity during checkout, sometimes invisibly, sometimes with a one-time code or a banking app prompt. Visa says its version, Visa Secure, helps prevent card-not-present fraud and can shift liability for authenticated or attempted transactions. Mastercard's program guide for Identity Check says a merchant that completes successful authentication "realizes the full benefits of liability shift", and it describes two types: fully authenticated, and merchant-only "attempts."
Without authentication, fraud chargebacks on CNP sales generally stay with the merchant. Each network's current chargeback rules decide which transactions qualify, so confirm what your gateway supports with your processor.
The Federal Reserve Payments Study found in-person card fraud fell from $3.7 billion in 2015 to $2.9 billion in 2016, while remote card fraud grew from $3.4 billion to $4.6 billion. The Fed noted the drop in counterfeit fraud coincided with a sharp increase in chip use. The data is old, but it shows why CNP sales now carry the fraud risk.
How to Take a Card-Not-Present Phone Order
Worked example 2: a $640 phone order, step by step
A fictional parts supplier, Example Supply Co., gets a call from a new customer, Sam Sample, who reads a Visa card number over the phone for a $640 part shipped to another state.
| Step | What you do | What it gives you |
| Collect | Card number, expiration, billing street address and ZIP, and the CVV2 code | What the issuer needs for its checks |
| Key it in | Enter the sale in your virtual terminal with every address field filled | A complete transaction; a missing ZIP can push a sale into a more expensive category |
| Read AVS and CVV2 | Say the CVV2 matches, the ZIP matches, and the street doesn't | Evidence the caller has the card, plus one warning sign |
| Drop the CVV2 | Don't write it on the order or save it anywhere | PCI compliance: the code can't be stored after authorization, even encrypted |
| Get it in writing | Email a credit card authorization form for signature before shipping | Your best evidence the cardholder agreed |
| Ship with tracking | Keep the delivery confirmation with the order | Proof if the dispute is "never received" |
A street mismatch on an order shipping out of state is a reason to check before you ship. One common policy: call the cardholder back at a number you look up yourself, and hold the part until you reach them.
An approval means the issuer let the sale through, not that Sam is the cardholder. Nothing here went through 3-D Secure, so if the real cardholder reports fraud, the chargeback generally stays with Example Supply. The AVS and CVV2 results, signed form and tracking number are its evidence.
On cost: if Sam's card is a Traditional Rewards card and the sale prices at Visa's card-not-present rate, interchange on $640 is 2.04% + $0.10, or $13.16. Tapped in person, it would be 1.65% + $0.10, or $10.66. Taking it by phone costs about $2.50 more in interchange.
How to Lower Card-Not-Present Fraud and Fees
These steps make CNP sales safer, and some make them cheaper:
- Use address verification (AVS). Visa describes AVS as a check of the cardholder's billing address with the issuer to reduce CNP risk. Decide in advance how you'll treat a mismatch.
- Ask for CVV2, but never keep it. The PCI Security Standards Council says merchants may request the code for CNP transactions, but it must not be stored after authorization, even encrypted, and even for card-on-file or recurring billing. If a PCI charge shows up on your statement, see our PCI non-compliance fee page.
- Turn on 3-D Secure where you sell online. Ask your gateway whether Visa Secure and Mastercard Identity Check are on. Visa's April 2026 schedule also offers small CNP interchange incentives on consumer credit (for example, -0.10% on eligible authenticated transactions) through its Digital Commerce Authentication Program.
- Store cards as tokens, not numbers. Tokenization swaps the card number for a substitute value, so your systems never hold the real one. Visa's schedule gives eligible EMV token transactions on consumer credit a -0.05% CNP incentive, and -0.15% when combined with authentication. A payment gateway with a built-in card vault handles this.
- Get signed authorization for phone, card-on-file and recurring charges. Our credit card authorization form guide has copy-ready templates and the PCI storage rules. If a customer pays by bank account instead, use an ACH authorization form.
- Send complete transaction data. Missing fields like the billing ZIP code can push a sale into a more expensive category. Ask your processor which of your sales fall into non-qualified or standard categories.
Against worked example 1, those incentives are modest. If all $50,000 qualified for the -0.10% authentication incentive, the $195 gap would shrink to $145. At -0.15%, it would be $120. Visa notes the incentives require CPS qualification and are subject to change, so turn these tools on for the fraud protection and count any savings as extra.
The full checklist is in credit card fraud prevention for small businesses.
Card-Not-Present Chargebacks and the Evidence to Keep
CNP sales carry more chargeback risk than card-present ones. No chip read proves the real card was used, so "I didn't make this purchase" disputes are harder to defend. And remote sales often involve shipping, delayed service or recurring charges, which add "never received" and "I canceled" disputes on top of fraud.
Your defense is the evidence you kept: AVS and CVV2 results, 3-D Secure records, signed authorization forms, delivery confirmation and clear cancellation terms. Start with what a chargeback is, tighten up with the chargeback prevention guide, and read how to win a chargeback before one lands. A sale refused up front is a different problem: see credit card decline codes. A pending amount a customer doesn't recognize may be an authorization hold that was never reversed.
If a big share of your sales are online, by phone or on file, send us a recent statement for a free statement review and we'll show you what your card-not-present transactions are costing and where it can come down.
This guide is general information, not legal advice. The card networks' current rules and your processing agreement govern the specifics.
Sources
- Visa USA Interchange Reimbursement Fees (rates effective April 18, 2026), observed September 2026.
- Visa press release, "Visa to Help Accelerate EMV Chip Migration and Support Merchants", observed September 2026.
- Visa, Visa Secure, observed September 2026.
- Visa, "3D Secure: your guide to safer transactions", observed September 2026.
- Visa, Verify cardholder information (AVS and CVV2), observed September 2026.
- Visa, Visa Token Service, observed September 2026.
- Mastercard Identity Check Program Guide (19 November 2019), observed September 2026.
- Federal Reserve Board, "Federal Reserve Payments Study finds U.S. payments fraud a small but growing fraction of overall payments" (October 16, 2018), observed September 2026.
- Federal Reserve Board, Regulation II (Debit Card Interchange Fees and Routing), observed September 2026.
- PCI Security Standards Council FAQ, "Are merchants allowed to request card-verification codes/values from cardholders?", observed September 2026.
- PCI Security Standards Council FAQ, "Can card verification codes/values be stored for card-on-file or recurring transactions?", observed September 2026.
Frequently Asked Questions
What is a card-not-present transaction?
It's any card payment where the physical card isn't read by your terminal at the time of sale. Online checkouts, phone and mail orders, invoice payment links, recurring billing, and charges to a card kept on file are all card-not-present.
What is the difference between card present and card not present?
A card-present sale is read by your terminal through the chip, a contactless tap or the magnetic stripe, and the chip creates a one-time code that shows the card is real. A card-not-present sale has no card at the terminal, so you rely on CVV2, address verification and 3-D Secure instead. That extra risk is priced in: in Visa's U.S. schedule effective April 18, 2026, a Visa Traditional Rewards credit card costs 1.65% + $0.10 when the card is present and 2.04% + $0.10 when it isn't, though regulated debit covered by the Federal Reserve's Regulation II carries the same rate either way.
Is a keyed-in transaction card-not-present?
Not always by label, but often by cost. In Visa's April 2026 debit tables, a keyed retail sale falls under CPS/Retail Key Entry in the card-present section, yet it carries the same 1.65% + $0.15 exempt debit rate as a card-not-present sale, versus 0.80% + $0.15 when the card is dipped or tapped. Key in a card only when the chip or tap truly fails.
Who is liable for fraud on a card-not-present transaction?
Generally the merchant, unless the transaction went through EMV 3-D Secure authentication (Visa Secure or Mastercard Identity Check), which can shift fraud liability to the card issuer for authenticated or attempted transactions. The chip-card liability shift applies to counterfeit fraud on in-person sales, not online or phone orders. Confirm the exact rules with your processor.
Can I store a customer's CVV code for future card-not-present charges?
No. The PCI Security Standards Council says card verification codes must not be stored after authorization, even encrypted and even for card-on-file or recurring transactions. You can ask for the code during a transaction, but store the card as a token in your gateway instead of keeping the number or the code.
About Payment USA’s Founder
Published by Payment USA, a merchant services provider. Our guides and comparisons reflect that commercial perspective.
Chase James
CEO, Payment USA
Chase James is the founder and CEO of Payment USA, a merchant services company built on transparency and fair pricing. With over 15 years in the payments industry, Chase has helped thousands of businesses uncover hidden processing fees and switch to honest, interchange-plus pricing.
Contact Chase →