Fraud — Card Not Present Defense Playbook

What This Dispute Means

A card-not-present (CNP) fraud chargeback is filed when a cardholder claims they did not authorize a transaction processed without the physical card being present — overwhelmingly e-commerce purchases. The cardholder is asserting that someone else placed the order using their card details, without their knowledge.

Unlike consumer dispute codes, there is no acknowledgment of a purchase relationship. The cardholder is not saying the item never arrived or wasn't what they expected — they are saying they had no involvement in the transaction at all. That makes it the most difficult dispute category to win, because the burden falls entirely on the merchant to prove the legitimate cardholder placed the order.

In a card-not-present environment, liability defaults to the merchant unless you can demonstrate that the legitimate cardholder was behind the transaction. If you processed with 3D Secure authentication and the cardholder authenticated, liability shifts to the issuer — and the chargeback should not be upheld. Without 3DS2, your defense relies on behavioral and technical evidence.

CNP fraud chargebacks are also the most common vehicle for friendly fraud — where the legitimate cardholder made the purchase, received the goods or service, and then disputed the charge to avoid paying. The evidence you need to defend against genuine third-party fraud is the same evidence that defeats friendly fraud claims: device fingerprints, IP geolocation, usage logs, and prior purchase history that proves the cardholder's identity was present at the transaction.

Network Coding

Each network uses a different code for this dispute type. The evidence requirements are similar across networks, but response windows, submission processes, and structural differences vary significantly. Our network-specific guides cover each one in detail.

Strongly Recommended Evidence

Required evidence establishes that the transaction was technically authorized. Strongly recommended evidence establishes that the cardholder's specific identity was present — making the dispute claim implausible regardless of what the cardholder asserts.

#4 — Usage logs and product access

#5 — Checkout consent and signed terms

• A screenshot or record of the checkout consent flow, showing the cardholder agreed to purchase terms at the time of the transaction.
• Signed terms of service if your checkout requires explicit acceptance.
• For subscription products: the original recurring billing authorization with full timestamp and IP address.

#6 — No pre-dispute fraud report

• Export your support records, CRM, and email history showing no report of unauthorized card use was received from the cardholder before the dispute was filed.
• A cardholder who "discovered fraud" but did not contact the merchant before filing the dispute is a consistent signal of friendly fraud.

Critical Mistakes

These mistakes appear in the majority of losing CNP fraud responses. They are avoidable — but only if you know what to look for before submitting.

Mistake #1: Submitting AVS and CVV as your primary defense

AVS confirms an address was entered correctly. CVV confirms the security code was entered. Neither proves the cardholder entered them — a fraudster with stolen card data that includes the billing address and security code will also pass both checks. Submitting AVS and CVV as your core evidence signals to arbitrators that you have nothing stronger.

Mistake #2: Missing network-specific deadlines

Amex gives you 20 days. Visa gives you 30. Mastercard gives you 45. Discover has an inquiry phase before the 30-day formal window. Missing any deadline is an automatic loss regardless of evidence strength. The variance across networks means you cannot apply a single mental deadline to all disputes.

Mistake #3: Submitting delivery evidence in an authorization dispute

A CNP fraud dispute is about authorization, not delivery. Submitting carrier tracking, shipping confirmations, and delivery photos does not address the cardholder's claim that they never placed the order. Delivery evidence is appropriate for "Item Not Received" disputes — not fraud codes.

Mistake #4: Ignoring Discover's inquiry phase

Discover sends an inquiry before most formal chargebacks — giving you the opportunity to resolve the dispute before it becomes a chargeback with associated fees and dispute rate impact. Merchants who ignore inquiries consistently receive formal chargebacks that a timely inquiry response would have prevented.

Mistake #5: Not capturing device and IP data at checkout

This is a structural problem, not a response problem. If your checkout does not capture and archive device fingerprints, IP addresses, and geolocation at the moment of authorization, you have no device-level identity evidence to submit — ever. This data cannot be reconstructed after the fact.

Winning Response Framework

This framework applies across all four networks. Adapt it to each network's specific form and submission process using the network-specific guides.

Step 1 — Identify the chargeback clearly

Step 2 — Lead with authorization and identity evidence

Do not make the reviewer infer authorization from raw data. State the facts of the authorization and identity match in plain language, then reference your exhibits.

Step 3 — Sequence your evidence by strength, not chronology

Step 4 — Label and explain each exhibit

Every piece of documentation should be named, numbered, and given a one-sentence explanation. Context shapes how evidence is perceived — do not make reviewers guess what they are looking at.

Proactive Prevention

The most effective CNP fraud defense is the evidence you collect before a dispute is ever filed. These steps reduce your exposure and build the documentation trail that makes responses straightforward.