Sponsor content is created on behalf of and in collaboration with Visa by DigitalCommerce360. Our editorial staff is not involved in the creation of the sponsored content.

CNP fraud is evolving
Card-Not-Present (CNP) transactions (remote purchases via web, app or phone) have grown rapidly as consumers demand convenient transactions and merchants aim to reduce checkout friction.

However, CNP fraud is rising as online transaction volumes increase and verification steps are reviewed. Cybercriminals are using automated tools and AI to exploit unguarded payment channels at scale. According to Visa data, CNP fraud rates run 7.5x to 8x higher than in-person sales, with global losses projected to reach $62.9 billion by 2027.

Addressing this growing threat requires a closer look at the inherent vulnerabilities of remote payments and the rapidly changing tactics bad actors use to exploit them.

Old fraud tactics gain new capabilities
Cybercriminals have been able to target vulnerabilities exposed in the absence of a physical card. Using stolen credentials from data breaches, fraudsters can perform account takeover (ATO) and automated card testing across checkout pages. They also use tactics such as synthetic identity fraud to combine stolen consumer data with fabricated details to create false identities that bypass basic verification.

Unfortunately, as modern technology accelerates, these threats are compounded through powerful new fraud tactics:

• Generative AI & deepfakes: Cybercriminals use AI tools to generate convincing fake identity documents, synthetic photos and cloned voices to easily bypass identity verification checks.
• Automated botnets: Attackers deploy networks of automated software scripts (bots) to rapidly test thousands of stolen payment cards or passwords across online checkouts in seconds.
• Fraud-as-a-Service (FaaS): Cybercrime groups package sophisticated hacking tools, automated scripts and stolen data into easy-to-buy online kits, enabling non-technical criminals to launch advanced attacks.
• Real-time & agentic AI environments: As payments move to instant rails and automated AI shopping agents, transactions complete in milliseconds, leaving traditional security systems almost no time to spot fraudulent activity.

This means that the fundamental objectives of fraud have not necessarily changed, but the tools available to execute them have.

Moving beyond static fraud prevention
Visa data shows that payment fraud costs roughly 3% of total e-commerce revenue, but security concerns cause merchants to reject an estimated 6% of valid orders. These false declines account for over $201 billion in lost global sales annually, and about 35% of shoppers will abandon a retailer after a single mistakenly rejected transaction.

Standard checks can’t keep up with AI bots using stolen data. To stop them, real-time behavioral analysis is needed to track how a user acts, not just the data they enter.

The main drawback of static rules is their high false-positive rate. When rigid parameters are applied across the board, routine transactions end up flagged as risky, adding unnecessary friction for shoppers even though roughly 99% of orders are legitimate.

Static checks miss modern threats. To catch them, it’s now necessary to turn to real-time behavioral monitoring that flags suspicious activity in milliseconds.

How merchants can balance fraud prevention with approval rates
Rather than treating every transaction with equal suspicion, merchants can help achieve maximum security and high approval rates by organizing defense around three core security principles:

1. Verify the person: Authenticate the buyer’s identity before purchase. Visa’s Network Verification Products can help validate cardholder data behind the scenes while reducing unnecessary While risk-based authentication (EMV 3DS) throughVisa Secure enables  contextual data to be exchanged silently between participating merchants and issuers. Plus, biometric tools like Visa Payment Passkey can help reduce reliance on  easily stolen passwords with device-bound verification (such as fingerprints or facial recognition).
2. Protect the credential: Protect sensitive payment data across its lifecycle using network tokenisation to replace card numbers with dynamic tokens. Consolidate these tokens across card networks into a single “super token” with Token Management Service (TMS) to streamline multi-channel payments, simplify PCI compliance and boost authorization rates.
3. Monitor the transaction: Screen each attempt in real time. Decision Manager adds a layer of behavioral analysis which helps merchants evaluate data against global intelligence to automate approvals and reduce manual reviews. Meanwhile, Visa Advanced Authorization (VAA) and Visa Deep Authorization (VDA) to score transaction authorization risk for issuers in real time and protect card-not-present sales with deep learning intelligence.

Together, identity verification confirms who is paying, tokenization protects what is used to pay and AI transaction monitoring screens how the payment behaves — enabling high approvals with minimal friction.

Preparing for the next generation of CNP threats
To counter fast-evolving attack tactics, card-not-present payment security must become as dynamic as the fraud it combats. Static rules can no longer keep pace with adaptive botnets, synthetic identities and AI-driven exploits.

By moving beyond rigid checks toward dynamic, multi-layered defense (combining real-time AI risk scoring, adaptive risk-based authentication and network tokenization) merchants can evaluate behavioral and contextual signals in milliseconds. This real-time agility allows payment security to automatically adapt to emerging threat patterns, stopping complex attacks before checkout while seamlessly approving genuine customers.