Who carries the fraud liability on a card-not-present payment?
By default, the merchant carries fraud liability on a card-not-present payment. The liability shift moves it to the issuer when the cardholder is authenticated with 3-D Secure, including frictionless approvals. If the merchant asks for an exemption and no authentication takes place, the fraud liability stays with the merchant.
In detail
By default, the merchant carries fraud liability on a card-not-present payment. If a cardholder disputes a remote transaction as fraudulent, the issuer can charge it back, and the merchant loses the sale amount plus dispute fees.
When liability shifts to the issuer
The liability shift applies when the issuer has authenticated the cardholder with 3-D Secure. A frictionless approval counts as much as a completed challenge. In that case, fraud disputes are no longer chargeable to the merchant.
When it does not
- The merchant or its PSP requested an exemption and no authentication took place.
- The payment was sent as MOTO or keyed manually.
- The authentication data was missing or did not match the authorization.
For a PayFac, this liability ultimately sits on its own balance sheet if a sub-merchant cannot pay. Authentication strategy is therefore a risk decision as much as a conversion one. Details in the episode on 3-D Secure and SCA exemptions, in Card-Present vs Card-Not-Present and on the Smart Checkout page.