Card-present vs card-not-present: the distinction that prices every transaction

One card, two prices: what actually changes

Take the same customer with the same card. At your counter, they tap: the chip generates a unique cryptogram for that transaction, cryptographic proof the genuine card was physically present. On your website that evening, they type the same 16 digits: no chip, no cryptogram, just knowledge of a number that could have been copied from anywhere.

The networks price that difference. Card-present transactions clear at lower interchange because counterfeiting a chip is impractical; card-not-present transactions clear higher because a stolen number is all an attacker needs. On a statement the same card commonly costs tens of basis points more accepted online than tapped, and the gap widens on premium cards. Multiply across a year of volume and the acceptance channel becomes a real line of cost.

The fraud and liability split

Since the EMV liability shift, counterfeit fraud on a chip-read transaction is generally the issuer's problem, not yours: you accepted the card with the strongest available verification, so the loss moves up the chain. This is why card-present fraud has collapsed as a merchant concern and why every terminal reads chips.

Card-not-present flips the default. When a cardholder disputes an online or keyed charge as fraud, the presumption runs against the merchant, and without countervailing evidence the chargeback usually sticks. The fraud economy noticed: as chips closed the counterfeit route, fraud migrated online, and CNP fraud now represents the overwhelming majority of card fraud losses in mature markets.

The exception that proves the rule is 3-D Secure. A CNP payment authenticated through 3DS, where the issuer verified the buyer via banking app or challenge, shifts fraud chargeback liability back to the issuer. It is the closest thing e-commerce has to a chip.

The CNP hierarchy: not all remote payments are equal

Within card-not-present there is a risk ladder. At the top, a hosted checkout or embedded fields flow with AVS, CVV and 3-D Secure: the address checks against the issuer's file, the security code proves physical possession once, and authentication can shift liability. In the middle, stored-credential payments on tokenized cards, where the first transaction was verified and subsequent ones ride on that verification. At the bottom, the keyed phone order: a number read aloud, typed into a virtual terminal, with whatever checks the clerk remembers to run.

Merchants cannot always choose their channel, a wholesaler cannot make customers walk into a store, but they can almost always climb the ladder within it. Replacing phone-keyed orders with a payment link moves the transaction into a proper checkout with AVS and 3DS. Vaulting repeat customers replaces monthly keying with tokenized billing. Each step is the same sale at lower risk.

What to actually do about it

In person: tap or insert everything, and treat a request to key a card at the counter as the anomaly it is. Manually keyed card-present transactions get CNP pricing and CNP risk with none of the CNP tooling.

Remotely: send links, do not take dictation. A payment link or invoice link costs the customer ten extra seconds and buys you AVS, CVV, 3-D Secure and a clean audit trail. Reserve the virtual terminal for the cases that genuinely need it, with AVS and CVV checks switched on.

Online: run the full stack. AVS plus CVV plus risk-based 3-D Secure catches most opportunistic fraud at negligible friction, and the liability shift on authenticated transactions changes the economics of the disputes that remain.

Then watch the split on your statement. RapidCents reporting separates card-present from card-not-present volume, so you can see each channel's true cost and fraud rate rather than one blended number, and Fee Check will show you the split from any statement you upload.