Card-Not-Present Fraud Prevention in 2026: What's Changed and What Works
Card-not-present fraud continues evolving in 2026. Here's what attack patterns are current, which prevention methods work best, and where the gaps remain.
3 June 2026
Card-not-present (CNP) fraud — where stolen card credentials are used in online transactions where the physical card isn't present — has evolved significantly over the past two years. The attack patterns of 2022 are mostly addressed by modern fraud stacks; 2026 fraud is more sophisticated, better-targeted, and increasingly automated.
Understanding the current threat landscape is the starting point for effective prevention.
Current CNP Fraud Attack Patterns in 2026
Synthetic identity fraud: Fraudsters combine real and fabricated data to create synthetic identities that pass KYC checks. These identities are "farmed" over months to build credit history before being used for fraudulent purchases. Unlike traditional account takeover, there's no single victim whose card was stolen.
AI-generated social engineering: Automated phishing campaigns using convincing AI-generated content now run at scale, harvesting card credentials from consumers who would have resisted cruder approaches. The result is a steady supply of freshly-compromised credentials entering the dark web.
Card-testing at scale: Automated bots test stolen card credentials against merchant checkout flows to identify valid cards before using them for high-value purchases. A single card-testing attack can generate thousands of micro-transactions in hours. See our card testing prevention guide for specific countermeasures.
Buy Now Pay Later (BNPL) fraud: BNPL platforms with lighter verification requirements have become a significant fraud vector, often targeting merchants integrated with these platforms.
Account takeover via credential stuffing: Automated attacks using lists of username/password combinations from previous data breaches to access customer accounts with stored payment methods.
What's Most Effective Against CNP Fraud in 2026
3DS2 with Maximum Data Submission
EMV 3DS2 is the single most effective CNP fraud tool available to merchants, but only when implemented fully. The protocol allows merchants to submit up to 150 data elements to card issuers for risk assessment — including device fingerprint, transaction history, and behavioral biometrics.
Merchants who submit only the mandatory data elements see frictionless authentication rates of 60–70%. Merchants who invest in full data submission see 85–90%+ frictionless rates. The additional data elements provide issuers with enough signal to approve legitimate transactions without friction while flagging anomalous ones for step-up authentication.
3DS2 also shifts liability for unauthorized transaction chargebacks to the issuer when authentication succeeds. This alone justifies the implementation cost for high-volume merchants.
Device Fingerprinting
Modern device fingerprinting combines hardware attributes, browser configuration, behavioral signals, and network characteristics into a unique device identifier. Unlike cookie-based tracking, fingerprints persist across browser clears and are harder to fake than IP addresses.
Linking device fingerprints to customer accounts and transaction history lets fraud models assess whether a transaction is coming from a device associated with the account or a new, unknown device. New device + high-value purchase + unusual shipping address is a high-signal fraud pattern.
For detailed coverage, see our device fingerprinting guide.
Velocity Controls
Velocity rules detect unusual transaction patterns associated with fraud: multiple transactions on the same card in a short period, multiple cards used from the same IP address or device, or rapid sequential attempts with slightly varying card numbers (card testing).
Velocity controls need regular calibration — they're among the most effective single controls against automated fraud attacks, but too-aggressive thresholds generate significant false positives for legitimate customers making multiple purchases.
Machine Learning-Based Risk Scoring
Real-time ML models trained on your transaction history and enriched with industry-wide fraud signals from consortium networks provide risk scores for each transaction. These models catch novel fraud patterns that rules engines miss because they haven't been explicitly programmed for them.
Key data inputs that improve ML fraud model performance:
- Order history and customer lifetime value
- Device fingerprint linking
- IP geolocation and proxy/VPN detection
- Email intelligence (age of email address, breach history)
- Behavioral biometrics (typing cadence, mouse movement)
What Doesn't Work Anymore
AVS matching alone: Address Verification Service checks are trivially bypassed by fraudsters who include the correct billing address associated with stolen card data. AVS is necessary but far from sufficient.
Simple velocity rules without ML: Rules-based velocity controls that aren't combined with risk scoring are too easily gamed by sophisticated fraud operations that pace attacks to avoid triggering thresholds.
Manual review at scale: Human review of suspicious transactions was viable at low volume. At modern e-commerce scale, manual review queues become backlogs and decisions lag fraud in real time.
For CNP fraud that results in chargebacks despite your prevention controls, Chargemate automates representment with device fingerprint data, authentication logs, and 3DS evidence — increasing win rates on unauthorized transaction disputes.
Frequently Asked Questions
Does implementing 3DS2 hurt conversion rates?
When implemented with full data submission, 3DS2 adds friction only to a small percentage of transactions where issuers request additional authentication. The conversion impact of a well-implemented 3DS2 program is typically -0.5 to -1% on challenged transactions, but the fraud reduction and chargeback liability shift more than compensate.
Should I block all VPN traffic?
Blocking VPN traffic outright creates significant false positives — many legitimate customers use VPNs for privacy. A better approach is to use VPN detection as one signal in a composite risk score rather than a hard block.
What's the most important single investment for CNP fraud reduction in 2026?
Full 3DS2 implementation with maximum data submission. Nothing else has the combination of fraud reduction, liability shift, and minimal conversion impact that a properly implemented 3DS2 program delivers.
How does fraud risk differ for digital goods vs physical goods?
Digital goods are higher fraud risk because there's no physical delivery to verify, no shipping address mismatch signal, and no opportunity to intercept after fraud detection. Digital goods merchants typically see 2–3x higher CNP fraud rates than physical goods merchants and benefit more from 3DS2 and velocity controls.