A card-not-present transaction (CNP, mail order / telephone order, MO/TO) is a payment card transaction made where the cardholder does not or cannot physically present the card for a merchant's visual examination at the time that an order is given and payment effected. It is most commonly used for payments made over the Internet, but can also be used with mail-order transactions by mail or fax, or over the telephone.
Card-not-present transactions are a major route for credit card fraud, because it is difficult for a merchant to verify that the actual cardholder is indeed authorizing a purchase.
If a fraudulent CNP transaction is reported, the acquiring bank hosting the merchant account that received the money from the fraudulent transaction must make restitution to the cardholder, which is called a chargeback. In addition, the merchant account would be assessed a chargeback fee by the acquiring bank.[1]
This is the opposite of a card present transaction, when the issuer of the card is liable for restitution.[2] Because of the greater risk, some card issuers charge a greater transaction fee to merchants who routinely handle card-not-present transactions.
The card security code (in this case, CVV2) system has been set up to reduce the incidence of credit card fraud arising from CNP.[3]
If a card is not physically present when a customer makes a purchase, the merchant must rely on the cardholder, or someone purporting to be so, presenting card information indirectly, whether by mail, telephone or over the Internet.[4]
Shipping companies may guarantee delivery of goods to a location, but they are normally not required to check identification and they are usually not involved in processing payments for the merchandise. A common preventive measure for merchants is to allow shipment only to an address approved by the cardholder, and merchant banking systems offer simple methods of verifying this information. Before this and similar countermeasures were introduced, mail order carding was rampant as early as 1992. A carder would obtain the credit card information for a local resident and then intercept delivery of the illegitimately purchased merchandise at the shipping address, often by staking out the porch of the residence.
Small transactions generally undergo less scrutiny, and are less likely to be investigated by either the card issuer or the merchant. CNP merchants must take extra precaution against fraud exposure and associated losses, and they pay higher rates for the privilege of accepting cards. Fraudsters bet on the fact that many fraud prevention features are not used for small transactions.
Merchant associations have developed some prevention measures, such as single-use card numbers, but these have not met with much success. Customers expect to be able to use their credit card without any hassles, and have little incentive to pursue additional security due to laws limiting customer liability in the event of fraud. Merchants can implement these prevention measures but risk losing business if the customer chooses not to use the measures.[5]
|
Main article: Carding (fraud) |
The United States Federal Trade Commission uncovered an operation running from 2006 to 2010 that netted more than $10 million in fraudulent charges on credit and debit cards. The perpetrators used more than 100 merchant accounts that they had created to do the billing.[2][6]
Each merchant account was attached to an Employer Identification Number belonging to a real merchant with a similar-sounding name.[6][7]
Each merchant account was tied to an 800-number from CallMe800.[6] Each account was also tied to a website they had created. They also rented physical addresses from companies which rent virtual offices, such as Regus (now IWG), for each merchant account. These virtual office companies, which did not know of and were otherwise not involved in the scam, would then forward any mail received at the virtual office to Earth Class Mail, a digital mailroom service that scanned mail from the physical address of the merchant account and forwarded it as a PDF to email accounts that the scammers had established.[2][6] The scammers also ensured that when they checked their online merchant accounts, that they used an IP address located near the billing address so as not to arouse suspicion.[6]
A charge of $9 was processed on about one million credit cards over the four-year period.[6] Each card was billed a single time. Credit card companies only investigate if the charge is more than $10 because it costs about that much to run an investigation. Then the money was moved to bank accounts in Lithuania, Estonia, Latvia, Bulgaria, Cyprus, and Kyrgyzstan where the money could not be traced or recovered. The perpetrators experimented with a 20-cent charge and that generated more suspicion than the $9 charge.[2] Only about 10 percent of the fraudulent charges were ever reported or contested by the card owner that was billed.[6][7]