Card-Not-Present Fraud Is Evolving. Is Payment Security Keeping Up?

CNP fraud is evolving

Card-not-present (CNP) transactions—purchases made online, in-app or by phone—continue to grow as consumers prioritize convenience and merchants streamline checkout.

However, as online transaction volumes increase, CNP fraud remains a significant challenge. Fraudsters are using automated tools and AI to exploit vulnerabilities in digital payment channels at scale. Visa reports that CNP fraud rates are 7.5 times higher than card-present fraud rates, while global CNP fraud losses are forecast to reach $43.6 billion by 2027.¹

Addressing this threat requires a closer look at the vulnerabilities of remote payments and the rapidly changing tactics fraudsters use to exploit them.

Old fraud tactics gain new capabilities

Without a physical card, fraudsters can exploit stolen credentials through account takeover (ATO), automated card testing and synthetic identities designed to bypass basic verification.

Emerging technologies can also make these tactics more sophisticated. Generative AI and deepfakes can create convincing fake documents, images and voices, while automated botnets can test stolen credentials at scale.

Fraud-as-a-Service (FaaS) can put sophisticated tools and stolen data into the hands of less technical criminals. Meanwhile, faster payment experiences and emerging agentic commerce may compress the time available to identify and interrupt suspicious activity.

The objectives of fraud may not have changed, but the tools available to pursue them have.

Moving beyond static fraud prevention

Fraud controls must balance risk reduction with customer experience. False declines—legitimate transactions incorrectly rejected as fraud—can frustrate customers, reduce revenue and weaken trust. Visa notes that global losses from false declines are projected to exceed $264 billion by 2027.²

Traditional checks alone may struggle to keep pace with automated attacks using stolen data. Real-time analysis can add behavioral, device and transaction context to help distinguish legitimate customers from suspicious activity.

Rigid rules applied without sufficient context can produce false positives and add unnecessary friction for legitimate shoppers.

Adaptive approaches can assess risk signals in real time and help identify suspicious activity within milliseconds.

How merchants can balance fraud prevention with approval rates

Rather than treating every transaction with equal suspicion, merchants can strengthen security while supporting approval rates by organizing their defenses around three core principles:

1. Verify the person: Help authenticate the buyer before purchase. Visa’s cardholder verification solutions can validate account and cardholder attributes before or during processing, helping reduce risk and payment friction. Risk-based authentication through Visa Secure, Visa’s EMV 3DS program, enables merchants to share transaction data with issuers so issuers can assess risk and determine whether additional cardholder verification is needed. Visa Payment Passkey uses a secure passkey associated with a cardholder’s device and supports authentication using a fingerprint, face or device PIN, helping replace passwords and SMS one-time codes at participating merchants.
2. Protect the credential: Help protect sensitive payment data across its lifecycle by using network tokenization to replace card numbers with tokens. Token Management Service provides a single integration point for accessing and managing network tokens across major card networks, helping simplify token management, reduce PCI DSS compliance scope and support higher authorization rates.
3. Monitor the transaction: Assess each transaction in real time. Decision Manager gives merchants AI-powered risk scores, automated decisioning and configurable controls that can help identify fraud, approve more genuine customers and reduce manual effort. Issuers can use Visa Advanced Authorization for real-time transaction risk scoring across card payments and Visa Deep Authorization for deep-learning risk scoring designed to help issuers detect CNP fraud and support better-informed authorization decisions.

Together, identity verification helps establish who is paying, tokenization helps protect the payment credential and transaction monitoring assesses payment behavior—supporting stronger security and smoother experiences for legitimate customers.

Preparing for the next generation of CNP threats

To counter fast-evolving attack tactics, CNP payment security must become as dynamic as the fraud it addresses. Static rules alone may not keep pace with adaptive botnets, synthetic identities and AI-enabled fraud.

By moving beyond rigid checks toward a dynamic, multilayered defense—including real-time AI risk scoring, adaptive risk-based authentication and network tokenization—merchants and issuers can evaluate behavioral and contextual signals within milliseconds. This approach can help organizations respond to emerging fraud patterns while minimizing disruption for legitimate customers.

Sources

1. Visa, “eCommerce fraud defense: tools, tactics and results.” CNP fraud rates and 2027 loss forecast.
2. Visa, “The future of fraud detection: smarter, faster, safer.” 2027 false-decline loss forecast.