Card-not-present transaction (CNP) is a card payment where no merchant terminal reads the card, so the merchant receives typed or stored details instead of chip data. Online checkouts, in-app purchases, subscription renewals, card-on-file charges and mail or telephone orders all qualify. In the EEA and UK most pass through 3-D Secure 2, since PSD2 requires strong customer authentication with dynamic linking for remote payments; MOTO sits outside that mandate. Static card data can be stolen and replayed, so most card fraud by value in Europe is CNP. A fraud chargeback on an unauthenticated CNP payment lands on the merchant, and acquirers underwrite merchants partly on their CNP share.
What is a card not present transaction
Online checkouts, in-app purchases, subscription renewals, card-on-file charges and mail order / telephone order sales are all CNP. The authorization message flags them through the entry mode and, online, an e-commerce indicator (ECI) telling the issuer whether the cardholder was authenticated.
What is a remote payment
The wider term is legally defined in Europe. PSD2 Article 4(6) describes a remote payment transaction as one initiated via the internet or a device used for distance communication, which also covers open banking transfers and mobile P2P payments. Article 97(2) adds dynamic linking: the SCA code must be tied to the exact amount and payee, so changing either invalidates it. MOTO payments are not initiated electronically by the payer, which keeps them outside the SCA mandate although the card is absent.
How do CNP transactions work
The checkout collects card number, expiry and security code, or retrieves a saved token. In the EEA and UK the payment usually passes through 3-D Secure 2 first: the issuer receives device and order data, then approves frictionlessly or challenges the cardholder in their banking app. The authentication value travels with the authorization through the gateway, acquirer and card network. Online retailers often authorize at order and capture at shipment, so funds can sit on hold for days.
How do remote payments work without a card
For account-to-account payments, a payment initiation service provider (PISP) redirects the payer to their bank, where they authenticate and approve the exact amount before the bank executes a credit transfer. No card data exists, so there is no CVV, no ECI and no card chargeback.
Remote vs card present payment
At a terminal the chip generates a one-time cryptogram proving the card was there. A remote payment offers only static data that can be stolen and replayed, which is why most card fraud by value in Europe is CNP fraud.
Liability follows. A fraud chargeback on an unauthenticated CNP payment lands on the merchant; once 3DS authenticates it, fraud liability generally shifts to the issuer. On a €500 order later disputed as fraud, that shift decides between losing €500 of goods plus a chargeback fee, or nothing.
In the US, card-not-present interchange categories sit above card-present ones. Within the EEA the Interchange Fee Regulation caps consumer debit at 0.2% and credit at 0.3% for both channels, so the gap comes mainly from acquirer pricing and fraud tools.
Why the CNP mix matters to a buyer
Acquirers and PSPs underwrite merchants partly on CNP share. A buyer of a payment company reviews CNP volume, fraud-to-sales and chargeback ratios per merchant, and any merchants in scheme monitoring programmes, since high-risk CNP books let acquiring partners demand larger reserves. For the in-person side, see card-present transaction.