Card-Not-Present Transaction (CNP)
PCIComplianceHubLast updated
A transaction where the card is not physically read by a terminal, covering e-commerce, mail order and telephone order. Because the chip cannot be used to prove the card is genuine, CNP transactions rely on data the cardholder supplies, such as the card verification value, address verification and 3-D Secure. CNP is where card fraud concentrated after EMV adoption, and it is the channel most PCI DSS e-commerce requirements are written to address.
Applies to. PCI DSS v4.0.1 names card-not-present only as an acceptance channel whose data flows the entity must identify in its scope confirmation under Requirement 12, alongside card-present and e-commerce. The channel drives the SAQ: under the SAQ Instructions, an e-commerce merchant that fully outsources its payment page to a validated third party fits SAQ A, one whose own site controls how card data is collected fits SAQ A-EP, mail and telephone orders keyed into a web-based virtual terminal fit SAQ C-VT, and a merchant that stores or processes card data in its own systems is on SAQ D. Because no terminal reads the card, the data the merchant holds is what the customer typed or said, so Requirement 3's ban on storing the card verification code after authorisation, Requirement 4's encryption of PAN over open networks and the payment page script and change-detection requirements added in v4 under Requirements 6 and 11 are the ones that matter most here; 3-D Secure is the brands' fraud tool for the channel, not a PCI DSS control.