At a Glance:

  • Card-not-present fraud occurs when stolen card information is used for purchases where the physical card isn't presented.
  • Safeguards such as Address Verification Service (AVS), Card Verification Value (CVV) verification, transaction monitoring, and fraud detection tools can help reduce risk.
  • Tracking approval rates, chargebacks, and refund response times may help businesses identify issues before they become costly.
  • Learn how PNC’s small business fraud mitigation tools can help you accept payments securely, manage fraud risk, and deliver a seamless customer experience.

For many small businesses, online sales are an essential part of doing business. Whether customers are shopping online, over the phone or on a mobile device, digital payments offer convenience and flexibility that today’s consumers expect.

But that convenience also comes with a growing risk: card-not-present (CNP) fraud.

As businesses expand their digital sales channels, understanding common CNP fraud schemes and implementing practical safeguards may help protect revenue, preserve customer trust, and reduce costly chargebacks.

“The good news is that reducing fraud doesn't have to mean creating a complicated checkout process,” says Sean McDonald, Head of Merchant Solutions at PNC Bank. “Many small businesses can help reduce risk by understanding the most common CNP fraud schemes and putting a few practical safeguards in place.”

What Is Card-Not-Present Fraud?

Card-not-present fraud occurs when someone uses stolen credit or debit card information to make a purchase without physically presenting a card.

The scale of the problem is significant: roughly 70% of all card-related fraud occurs in card-not-present transactions, and global CNP fraud losses are projected to reach $49 billion by 2030 [1].

Because the physical card isn’t presented, businesses may have more difficulty confirming that the person making the purchase is the authorized cardholder. While fraud can affect businesses of all sizes, small businesses often feel the impact more directly through chargeback losses and the time required to resolve disputes.

Card Testing

One of the most common forms of CNP fraud is card testing. Fraudsters use stolen card data to determine whether an account is active, usually by submitting multiple low-dollar transactions before attempting larger purchases.

Signs of card testing may include:

  • A sudden increase in small-dollar transactions
  • Multiple payment attempts using different cards
  • An unusually high volume of declined transactions

"Many business owners expect fraud to show up as one large suspicious transaction," McDonald says. "In reality, it often starts with a series of small transactions designed to see whether a stolen card will go through.”

Triangulation Fraud

Triangulation fraud is more complex. In this scheme, a fraudster creates a fake online storefront and accepts payment from unsuspecting customers. The criminal then uses stolen payment information to purchase products from a legitimate merchant and has those items shipped directly to the customer.

The customer receives the merchandise and may never realize anything is wrong. Meanwhile, the legitimate merchant can face chargebacks and financial losses when the stolen card transaction is ultimately reported.

Because these transactions can initially appear legitimate, businesses should monitor unusual order patterns and shipping activity that differs significantly from normal customer behavior.

Friendly Fraud

Not all chargebacks stem from criminal activity.

Friendly fraud occurs when a cardholder disputes a valid transaction. It may be unintentional – for example, when a customer does not recognize a charge – or intentional, such as when a customer knowingly disputes a legitimate purchase to obtain a refund while keeping the product or service. In other cases, a customer may bypass a merchant's refund process and go directly to their card issuer.

Common examples include:

  • a customer doesn't recognize the business name on their statement;
  • a family member makes a purchase without the cardholder's knowledge;
  • a customer forgets about a recurring payment; or
  • a customer knowingly disputes a legitimate purchase to receive a refund while keeping the product or service.

“Friendly fraud is one of the most common challenges online merchants face,” McDonald points out. “Some disputes begin with confusion, while others may involve intentional misuse of the chargeback process. Clear communication before and after a purchase may help prevent unnecessary disputes and support a merchant's response when a valid transaction is challenged.”

Building a Right-Sized Fraud Prevention Strategy

Small businesses don't need a dedicated fraud team or enterprise-sized budget to strengthen payment security. Often, the most effective approach is layering multiple safeguards together.

Use Address Verification Service (AVS)

AVS compares the billing address entered during checkout with the information the card issuer has on file. Mismatches can help identify potentially fraudulent transactions before they are approved.

PNC’s Account Verification Services helps businesses detect and avert potential imposter fraud schemes and scams aimed at diverting legitimate payments to a criminal.

Require CVV Verification

Requiring the card's security code adds another layer of validation and may help prevent unauthorized use of stolen account numbers.

Monitor Transaction Volume

Transaction monitoring tools can flag an unusual number of payment attempts from the same device, account or IP address within a short period. This activity may be an early sign of a card-testing attack.

Leverage Advanced Fraud Detection Tools

Modern fraud prevention tools evaluate device information, transaction patterns, purchasing behaviors and risk signals in real time to identify activity that falls outside normal customer behavior.

For example, PNC Merchant Services® offers fraud management capabilities that may help businesses screen transactions, monitor suspicious activity and apply risk-based controls designed to balance security and customer experience.

Three Metrics Worth Tracking Every Month

“Dozens of data points can provide insight into the health of a small business’s fraud controls,” says Josh Del Valle, PNC’s Head of Enterprise Fraud. “But monitoring a few key indicators can help business owners quickly identify potential issues and determine where adjustments may be needed.”

1. Approval Rate

This measures the percentage of transactions that are successfully authorized.

A declining approval rate could indicate that fraud controls are creating unnecessary friction for legitimate customers or that payment processing issues need attention.

2. Chargeback Ratio

This tracks the percentage of transactions that result in chargebacks. As a practical warning benchmark, a chargeback ratio approaching 1% deserves prompt attention because card networks and payment processors may begin subjecting merchants to additional scrutiny at or near that level.

An increase in chargebacks may signal fraud activity, customer-service issues, billing confusion, or gaps in the checkout experience.

3. Refund Processing Time

How quickly a business responds to refund requests can directly affect customer satisfaction and dispute rates.

“When customers can quickly resolve an issue with the merchant, they're often less likely to escalate it into a chargeback,” Del Valle says. “Fast responses and good documentation can make a meaningful difference.”

Small Steps Can Deliver Big Benefits

Card-not-present fraud is an increasingly common reality of digital commerce, but it doesn't have to become a cost of doing business. By understanding common fraud schemes, implementing layered controls, and keeping an eye on a few key performance indicators, businesses may better protect revenue while maintaining a positive customer experience.

“As online commerce continues to evolve, so will fraud tactics," Del Valle notes. “The businesses that stay informed and proactive are often best positioned to protect both their operations and their customers.”

Protect Your Business with Smarter Payment Security

Protect your business with payment solutions designed for today's digital environment. Learn how PNC’s small business fraud mitigation tools can help you accept payments securely, manage fraud risk and deliver a seamless customer experience.

FAQ:

What is the difference between card testing and friendly fraud?

Card testing involves criminals using stolen card information to determine whether an account is active, often through small transactions. Friendly fraud occurs when a legitimate cardholder disputes a valid purchase, either because of confusion or intentional misuse of the chargeback process.

What is a good chargeback ratio for a small business?

A small business should generally aim to keep its chargeback ratio well below 1%. A ratio approaching 1% deserves prompt attention because it may signal fraud, customer-service problems or billing confusion.

How does AVS help prevent card-not-present fraud?

AVS compares the billing address provided at checkout with the address the card issuer has on file. A mismatch can alert a business to a potentially fraudulent transaction before the purchase is approved.

What should I do if I suspect a triangulation fraud scheme?

Pause fulfillment when possible, review the order for unusual payment or shipping patterns, and contact your payment processor for guidance. Keep transaction, delivery and customer-communication records in case you need to respond to a dispute.