Card not present transaction

A card not present transaction (CNP, MO/TO, Mail Order / Telephone Order, MOTOEC) is a payment card transaction made where the cardholder does not or cannot physically present the card for a merchant's visual examination at the time that an order is given and payment effected, such as for mail-order transactions by mail or fax, or over the telephone or Internet.

Card not present transactions are a major route for credit card fraud, because it is difficult for a merchant to verify that the actual cardholder is indeed authorizing a purchase.

If a fraudulent CNP transaction is reported, the acquiring bank hosting the merchant account that received the money from the fraudulent transaction must make restitution; whereas with a swiped (card present) transaction, the issuer of the card is liable for restitution.^[1] Because of the greater risk, some card issuers charge a greater transaction fee to merchants who routinely handle card not present transactions.

The card security code system has been set up to reduce the incidence of credit card fraud arising from CNP.

Mail-order fraud

If a card is not physically present when a customer makes a purchase, the merchant must rely on the cardholder, or someone purporting to be so, presenting card information indirectly, whether by mail, telephone or over the Internet.

Shipping companies may guarantee delivery of goods to a location, but they are normally not required to check identification and they are usually not involved in processing payments for the merchandise. A common preventive measure for merchants is to allow shipment only to an address approved by the cardholder, and merchant banking systems offer simple methods of verifying this information. Before this and similar countermeasures were introduced, mail order carding was rampant as early as 1992. A carder would obtain the credit card information for a local resident and then intercept delivery of the illegitimately purchased merchandise at the shipping address, often by staking out the porch of the residence.

Small transactions generally undergo less scrutiny, and are less likely to be investigated by either the card issuer or the merchant. CNP merchants must take extra precaution against fraud exposure and associated losses, and they pay higher rates for the privilege of accepting cards. Fraudsters bet on the fact that many fraud prevention features are not used for small transactions.

Merchant associations have developed some prevention measures, such as single use card numbers, but these have not met with much success. Customers expect to be able to use their credit card without any hassles, and have little incentive to pursue additional security due to laws limiting customer liability in the event of fraud. Merchants can implement these prevention measures but risk losing business if the customer chooses not to use the measures.

Fraud

The United States Federal Trade Commission uncovered an operation running from 2006 to 2010 that netted more than $10 million in fraudulent charges on credit and debit cards. The perpetrators used more than 100 merchant accounts that they had created to do the billing.^[1][2]

Each merchant account was attached to an Employer Identification Number belonging to a real merchant with a similar sounding name.^[2][3]

Each merchant account was tied to an 800-number from CallMe800.^[2] Each account was also tied to a web site they had created. They also rented physical addresses from companies which rent virtual offices, such as Regus, for each merchant account. These virtual office companies, which did not know of and were otherwise not involved in the scam, would then forward any mail received at the virtual office to Earth Class Mail, a digital mailroom service that scanned mail from the physical address of the merchant account and forwarded it as a PDF to email accounts that the scammers had established.^[1][2] The scammers also ensured that when they checked their online merchant accounts, that they used an IP address located near the billing address so as not to arouse suspicion.^[2]

A charge of $9 was processed on about one million credit cards over the four-year period.^[2] Each card was billed a single time. Credit card companies only investigate if the charge is more than $10, because it costs about that much to run an investigation. Then the money was moved to bank accounts in Lithuania, Estonia, Latvia, Bulgaria, Cyprus, and Kyrgyzstan where the money could not be traced or recovered. The perpetrators experimented with a 20-cent charge and that generated more suspicion than the $9 charge.^[1] Only about 10 percent of the fraudulent charges were ever reported or contested by the card owner that was billed.^[2][3]

References

1. Stross, Randall (August 21, 2010). "$9 Here, 20 Cents There and a Credit-Card Lawsuit". New York Times. Retrieved 2010-08-24. If a credit card is physically swiped in the transaction, the bank that issued the card is on the hook for fraudulent charges. If it is a phone or Internet purchase — called a card-not-present transaction — the bank that hosted the merchant account that received the ill-gotten charges must make restitution, said Ms. Litan, the Gartner analyst.
2. "FTC Says Scammers Stole Millions, Using Virtual Companies". PCWorld. June 27, 2010. Retrieved 2010-08-25. The scammers stayed under the radar by charging very small amounts — typically between $0.25 and $9 per card — and by setting up more than 100 bogus companies to process the transactions. ... According to the FTC, the fraudsters charged 1.35 million credit cards a total of $9.5 million, but only 78,724 of these fake charges were ever noticed.
3. "FTC Cracks Down On Micropayment Credit Card Scam". CRN. June 28, 1010. Retrieved 2010-08-25. Altogether, the thieves charged a total of $9.5 million from a total of 1.35 million compromised cards over a period of four years starting in 2006. However, only about 10 percent of the fraudulent charges were ever reported or contested, according to the FTC.