How should merchants reduce card-not-present fraud before they approve an order?

How to reduce card-not-present fraud before approval

Card-not-present review works best when you treat the order as a risk decision, not just a payment authorization. The strongest practical approach is to combine payment verification, address consistency, device and location checks, and customer-data coherence into one approval flow. That reduces obvious impersonation attempts without forcing every borderline order into manual review.

What the pre-approval signals are actually telling you

Each signal answers a different question about whether the purchaser looks like the legitimate cardholder. CVV2 checks whether the person has the card details; AVS checks whether the billing address aligns; shipping and billing consistency helps reveal mismatched fulfillment patterns; IP location and customer-data coherence can expose proxy use, synthetic identities, or rushed checkout behavior.

None of these signals is perfect on its own. Fraudsters often defeat one control but rarely align several weak signals at once, which is why the decision should be based on the pattern across the transaction rather than any single field. The useful question is whether the order is internally believable enough to pass with low friction.

Merchants that want a stronger baseline can also compare their approval logic with PCI DSS v4.0, which anchors payment security expectations around protecting card data and maintaining disciplined controls around the payment flow.

Risk and Threat Considerations

Card-not-present fraud is a classic trust-boundary problem: the merchant cannot physically inspect the card, so the attacker only needs enough stolen or synthetic data to look plausible at checkout. If the approval process relies on one weak signal, bad orders slip through and later surface as chargebacks, fulfillment loss, or repeated abuse from the same pattern.

Failure mechanism: Fraud succeeds when the merchant approves orders on partial identity evidence, especially when billing, shipping, and location signals are inconsistent but not jointly evaluated. Attackers exploit gaps between payment verification and order-level review, then scale the same pattern across many attempts.

Impact: The business absorbs chargeback exposure, goods-loss risk, and operational noise from avoidable manual reviews. Over time, weak pre-approval controls also make fraud harder to separate from legitimate customer friction, which can push merchants toward either overblocking or underblocking.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

PCI DSS v4.0 provides the primary governance reference for this topic.

Framework	Control / Reference	Relevance
PCI DSS v4.0	8.3 — Additional Authentication for Access to Payment Data	Card-not-present checkout depends on authenticating payment use before approval.
	6.4 — Public-Facing Web Applications	Online checkout is a public-facing payment path that needs controlled change and integrity protections.
	10.2 — Audit Logs	Fraud review depends on retaining evidence from AVS, CVV2, IP, and order decisions.
Recommendation — Require stronger cardholder verification where transaction risk is elevated. Protect the checkout flow from tampering that could weaken fraud checks. Log pre-approval signals and review outcomes for fraud analysis and chargeback defense.

Practitioner Guidance

What to prioritise: Build a simple scorecard that weights CVV2, AVS, shipping and billing match, IP geography, and customer-data coherence together. The goal is not to prove legitimacy, but to identify orders that are clearly inconsistent enough to stop or review.

What to verify: Make sure mismatches are interpreted in context. A single failed check may be normal for some customers, but repeated mismatches across several signals should trigger a stricter decision, especially when the order size, shipping speed, or first-time customer profile increases exposure.

Practitioner takeaway: The best fraud controls are layered and proportional, because pre-approval review works only when weak signals are combined into a consistent risk judgment rather than treated as isolated pass-or-fail checks.

#1 Authority in NHI Education, Research and Advisory, empowering organizations to tackle the critical risks posed by Non-Human Identities (NHIs), including AI Agents.