Card-Present vs Card-Not-Present: What Changes for Payments (2026)

Card-present vs card-not-present is the split between payments where the physical card, or a device holding it, is read by a terminal, and payments made remotely with card details only. Card-present covers chip, contactless and wallet taps in store. Card-not-present covers e-commerce, in-app, phone and mail orders, and recurring billing.

In 2026 the line still decides almost everything that matters to an operator: which authentication applies, who pays for fraud, what the interchange is and how disputes are handled. It is also blurring. Tap to Pay on phones, payment links sent from a store and wallets used online mix both worlds, and PSPs, PayFacs and platforms have to tag each payment correctly to price it and protect it.

What is the difference between card-present and card-not-present?

A card-present (CP) transaction is one where card data is captured by a terminal from the chip, the contactless antenna or, as a last resort, the magnetic stripe. A card-not-present (CNP) transaction is one where the merchant receives the card number, expiry date and security code without any terminal reading the card. The card schemes define the two environments in their rules and carry the distinction in every authorization message, through the point-of-service entry mode and the transaction indicators set by the acquirer.

The standard behind card-present security is EMV, the chip specification managed by EMVCo. According to EMVCo’s deployment statistics, 97% of card-based transactions worldwide were EMV chip transactions in the twelve months to Q4 2025. The standard behind card-not-present security is EMV 3-D Secure, covered in our episode on 3-D Secure and SCA exemptions. Related notions:

• EMV chip: the chip creates a one-time cryptogram for each payment, so copied card data cannot be replayed at another terminal.
• Chip and PIN: the chip proves the card is real, and the PIN proves the cardholder is there. Contactless and wallets replace the PIN with a limit or a device biometric.
• MOTO: mail order and telephone order, a card-not-present payment keyed by the merchant’s staff rather than by the shopper.
• Liability shift: the scheme rule that moves the cost of fraud to the party that did not support the stronger technology, or to the issuer once it has authenticated the cardholder.

Card-present vs card-not-present: what changes in practice?

The two environments differ on five points: how the card is read, how the cardholder is verified, who is liable for fraud, what the payment costs and how a dispute is defended.

• Data capture: CP reads the chip or a tokenized device and receives a dynamic cryptogram. CNP receives static data, the same number every time, unless a network token is used.
• Cardholder verification: CP uses PIN, signature in a few markets, or the phone’s biometric. CNP uses the CVV, address checks and 3-D Secure.
• Fraud liability: in CP, counterfeit fraud on a chip transaction is generally the issuer’s problem. In CNP, the merchant carries fraud by default, unless the issuer authenticated the payment.
• Cost: schemes publish separate interchange rates for each environment, and CNP is usually the more expensive one outside regulated domestic caps.
• Disputes: a CP merchant defends with the chip data and the terminal receipt. A CNP merchant needs proof of authentication, delivery and customer history.
• Regulation: in Europe, strong customer authentication applies to both, with different exemptions: contactless limits in store, low-value and risk-based exemptions online.

Some payments sit in between. A wallet tap in store is card-present. The same wallet used on a website is card-not-present, but it carries a device cryptogram that the schemes treat as strong evidence. A payment link opened by a shopper standing in a store is card-not-present, whatever the sales assistant thinks.

SoftPOS, also called Tap to Pay, adds another case. A standard phone becomes the terminal, with no extra hardware. The payment is still card-present, because the phone reads the contactless chip and receives a cryptogram, but the device is a consumer product that the operator must certify, monitor and keep updated.

How does a card-present or card-not-present payment work?

Both flows end with the issuer’s answer, but they start differently and carry different evidence along the way.

1. Capture: in store, the terminal reads the chip or the contactless device. Online or by phone, the checkout page or the agent’s virtual terminal collects the card number, expiry date and CVV.
2. Verification: in store, the cardholder enters a PIN or unlocks a phone. Online, the merchant’s PSP may trigger 3-D Secure, where the issuer checks the cardholder silently or with a challenge.
3. Message building: the acquirer, or the PSP on its behalf, builds the authorization request. It sets the entry mode (chip, contactless, keyed, e-commerce, MOTO, recurring) and attaches the chip cryptogram or the 3-D Secure result.
4. Scheme routing: the card network forwards the request to the issuer, found through the card’s BIN, and adds its own risk scoring.
5. Issuer decision: the issuer validates the cryptogram or the authentication data, checks funds and risk, then approves or declines. Issuers decline card-not-present payments more often, because they have less evidence.
6. Clearing and interchange: the transaction qualifies for a card-present or card-not-present interchange rate according to the data it carried.
7. Disputes: if the cardholder later claims fraud, the liability rules of the environment decide whether the issuer or the merchant absorbs the loss.

The flags set in step 3 are the weak point. A keyed payment sent as e-commerce, or a recurring payment sent without its indicator, can lose its exemption, its interchange rate or its dispute rights.

Card-present vs card-not-present in numbers (2026)

A few dated figures show how differently the two environments behave.

• 97%: share of card-based transactions worldwide that used EMV chip in the twelve months to Q4 2025, according to EMVCo.
• EUR 1.33 billion: card fraud on EU-issued cards in 2024, up 29%, in the joint EBA-ECB report on payment fraud published in December 2025. The same report finds card fraud 17 times higher when the counterparty is outside the EEA, where strong customer authentication is not required.
• 17.1%: share of US retail sales made online in Q2 2026, according to the US Census Bureau. Most card spending still starts in a store, but the remote share keeps rising.
• 0.05% + $0.21 vs 1.65% + $0.15: Visa’s US interchange for a regulated debit card in a store and for an exempt debit card used online, in Visa’s US interchange schedule effective October 24, 2026.
• 0.2% and 0.3% vs 1.15% and 1.5%: caps on non-European consumer cards used in the EEA, in store (debit, credit) and online, under commitments that Visa and Mastercard extended until November 2029.

What are the risks and limits of each environment?

Neither environment is safe by design. Each has its own failure modes, and the worst ones come from treating one like the other.

• Fraud migration: chip made counterfeit cards hard to use in stores, so fraud moved to remote channels. Any channel left without authentication becomes the next target, a race described in AI vs fraud in payments.
• Fallback transactions: when a chip cannot be read, terminals may fall back to the magnetic stripe or to manual key entry. These payments lose chip protection and are a classic source of chargebacks.
• MOTO abuse: in Europe, mail and telephone orders fall outside the strong customer authentication rules set by the regulatory technical standards on SCA, so issuers watch the MOTO flag closely. Sending e-commerce payments as MOTO to avoid 3-D Secure is a scheme violation.
• Friction: every extra check in card-not-present costs conversions. Challenge success rates vary widely by country, which makes a single global rule expensive.
• Liability surprises: the shift to the issuer only applies when authentication really took place. As this guide to the 3-D Secure liability shift explains, a merchant-requested exemption leaves the fraud risk with the merchant.
• Offline terminals: card-present payments accepted offline, on planes or at events, are authorized later and can be declined after the goods have gone.

Card-present vs card-not-present: what changes for PSPs, PayFacs and platforms

Operators that serve merchants in both channels have to run two rulebooks on one platform. Five areas need attention.

Onboarding and risk

The channel mix is a core underwriting input. A business that sells only at a counter has a different fraud and dispute profile from one that takes orders by phone or ships abroad. A PayFac should record the expected share of card-present, e-commerce and MOTO volume at onboarding, then monitor drifts. A florist whose MOTO share jumps from 5% to 60% has changed its risk, even if its turnover has not.

Authentication and checkout

Online, the operator decides when to request 3-D Secure, when to ask for an exemption and how to present the challenge. These choices drive both conversion and liability, as discussed in payment authentication, 3-D Secure and delegated SCA. In the NORBr platform, Smart Checkout lets an operator run the payment page under its own brand and adapt the flow to each merchant.

Routing and acquirers

Many acquirers are strong in one environment only, and terminal estates are often tied to a local acquirer. A platform expanding abroad may end up with one partner per country in store and another online, a situation described in scaling in-store payments across countries. In Germany, for instance, the domestic debit scheme works in stores but not in standard online checkouts, as the guide to payment methods in Germany shows.

Reconciliation and reporting

In-store and online payments usually arrive from different providers, in different formats, with different identifiers. Merchants still want one view. NORBr brings card-present and card-not-present transactions into the same reporting model, and its in-store payments Matcher™ links cashier tickets to terminal payment notifications, as explained in how Matcher™ matches store receipts with payments. That is the foundation of unified commerce and of omnichannel coverage for a payment operator.

Pricing and disputes

Because interchange fees differ by environment, an operator that sells one blended rate across channels takes a margin risk on every keyed or cross-border payment, as the episode on the merchant discount rate shows. Chargeback handling differs too: card-present cases rely on terminal data, card-not-present cases on authentication and delivery proof. Storing both sets of evidence with each transaction shortens every response.

For outside reading, the Payments Library lists where strong customer authentication for payments is heading. The #TheShot episode how 3-D Secure changed online payments tells the story from the practitioner’s side, and 3-D Secure enforcement around the world shows how the rules differ by region.

Is it still worth separating card-present and card-not-present in 2026?

Yes. The technologies converge, but the rules, costs and liabilities do not. What changes by player:

• PSPs: must tag every transaction precisely. Entry modes and indicators decide interchange, exemptions and dispute rights.
• PayFacs: should underwrite and monitor by channel mix, and treat sudden MOTO or keyed volume as a risk signal.
• ISOs: selling terminals alone is no longer enough. Merchants expect one contract and one report for store and web.
• ISVs and platforms: the opportunity is to hide the split from merchants while handling it correctly underneath.

Card-present and card-not-present are two sets of evidence for the same question, “is this really the cardholder?”, and operators that manage both on one platform price, protect and report payments more accurately.