Quick answer: A card-not-present payment is any card sale where you never see the physical card, like an online order or a phone order. These sales carry more fraud risk than in-person ones, and merchants tend to absorb most of the loss. You cannot remove the risk, but you can lower it with the right checkout tools and a few habits.
Below: what counts as card-not-present, what the latest Federal Reserve data shows, how the fraud works, and five steps to take.
What counts as a card-not-present payment?
Anything where the customer gives you card details without the card itself being read by your terminal:
- Orders from your online store
- Payments by phone
- Invoices paid online
- Recurring payments and subscriptions
The difference matters because a chip or a PIN cannot check the card. You, or your payment processor, have to find another way to confirm the buyer is who they say they are.
How big is the risk?
The Federal Reserve’s report on 2023 debit card activity, published in December 2025, gives the clearest recent numbers. It covers debit cards from larger issuers, so it is a guide to the pattern, not to credit cards as well.
| Card-not-present debit payments, 2023 | Share |
|---|---|
| Of all transactions | 34.4% |
| Of all transaction value | Almost half |
| Of all fraud losses | 54.3% |
| Of those fraud losses, the share merchants absorbed | 65.1% |
Read those last two lines together. Card-not-present fraud is more than half of all the fraud in the report, and merchants carry about two-thirds of that cost. When a fraudulent online sale is reversed, you can lose the money and the goods.
How does card-not-present fraud usually work?
- Stolen card numbers. A criminal buys card details and uses them to place an order. The real cardholder may not notice until the charge appears.
- Phishing. CISA describes phishing as criminals trying to get people to open harmful links, emails or attachments to steal personal information. Your customers can be the targets, and so can you.
- Attacks on your checkout. If a criminal gets into your site, they can try to record what shoppers type. This is why keeping your site updated matters. Our guide to malware protection explains the basics.
How can you lower your risk?
- Let your processor handle the card data. The less card data you touch, the less there is to steal. Our guide to how payment processors handle sensitive data explains how this works.
- Follow PCI DSS. The PCI Security Standards Council sets the data security rules for businesses that take card payments. Ask your processor which parts it covers for you.
- Ask about 3-D Secure. EMV 3-D Secure lets the card issuer and the merchant authenticate the buyer, to guard against card-not-present fraud.
- Look twice at odd orders. Be careful with rush shipping on an expensive first order, several orders in a row on different cards, or a billing and shipping address that do not match. A short call or email is cheaper than a reversed sale.
- Keep records. Save order details, shipping proof and messages. You will need them if a customer disputes a charge.
What does Turbify offer for this?
Turbify Payments provides payment processing for small businesses and ecommerce merchants, with fraud monitoring and risk scoring. Turbify Stores plans include fraud detection along with credit card and PayPal processing. Free SSL comes with every hosting plan, so your checkout page is encrypted.
Our guide to accepting payments online walks through the full setup.
Quick answers
Who pays when a card-not-present sale turns out to be fraud?
It depends on the case, but merchants often do. In the Federal Reserve’s 2023 debit data, merchants absorbed 65.1% of card-not-present fraud losses. Ask your processor how disputes work under your agreement.
Are phone orders card-not-present?
Yes. So are mail orders and any payment where you type in card details rather than reading the card.
Does SSL stop card-not-present fraud?
No. SSL protects the data while it travels between the shopper and your site. It does not tell you whether the card belongs to the person using it.
Do I have to follow PCI DSS?
The standard applies to businesses that take card payments. Your processor can explain what your setup requires. For legal questions, talk to your own advisor.
Your next step
Look at your last ten online orders. Would you have caught a fraudulent one? If you are not sure, ask your processor what fraud tools you already have turned on.
Keep customer data safe. Turbify includes free SSL on every hosting plan, with payment tools built for small business. See Turbify Payments.
