Card Present vs. Card Not Present Transactions Explained

The card-present vs card-not-present distinction is the single biggest driver of what a sale costs you to process. A card-present transaction is one where the physical card is at the point of sale and gets dipped, tapped, or swiped. A card-not-present transaction is everything else: online, over the phone, by mail order, or through a stored card on file. The difference costs you real money on every sale, and you can see exactly how much in Visa's own published rates.

The Price Gap, Straight From Visa's Schedule#

Visa publishes its full US interchange schedule as a public document. The current edition is dated April 18, 2026. Here's what it lists for a consumer check card from an exempt issuer (Visa, 2026):

Same card. Same issuer. More than double the percentage rate depending on how the sale happened. On a $100 transaction that's about $0.95 in the store against about $1.80 online.

That gap is not your processor marking you up. It's interchange, set by the network and paid to the card-issuing bank, and it exists because the two channels carry genuinely different fraud risk.

The Detail That Surprises Retailers#

Look at one more line from the same schedule: CPS/Retail Key Entry, Debit runs 1.65% + $0.15.

That's a transaction where the card is physically in front of you and your staff typed the number in instead of dipping it. It costs the same as a pure e-commerce sale.

So the discount isn't really for the card being present. It's for the card being electronically authenticated at the moment of sale. A chip read proves the card is genuine. A typed number proves nothing, whether the customer is standing in front of you or calling from another state.

If your terminal is unreliable and staff key transactions to get through a queue, that habit is costing you roughly double the interchange on every keyed sale. It's one of the cheapest things to fix in a retail operation.

Regulated Debit Ignores the Channel Entirely#

Here's a wrinkle worth knowing, because it changes the calculus depending on your customer base.

For debit cards from covered issuers, Regulation II caps interchange at $0.21 plus 0.05 percent of the transaction, plus a $0.01 fraud-prevention adjustment where eligible (Federal Reserve). Covered issuers are banks with $10 billion or more in assets.

Visa's schedule reflects that. Every regulated line, card present or card not present, reads 0.05% + $0.21. The channel makes no difference at all.

So the card-present advantage only shows up on exempt debit and on credit. When a customer pays with a debit card from a large bank, your cost is the same whether they're in the store or on your website. That's a Durbin artifact, not a network judgment about risk, and it means the size of your card-present savings depends partly on which banks your customers use.

Why the Fraud Risk Actually Differs#

The underlying reason is authentication, and the dividing line is EMV.

An EMV chip generates a one-time code for every transaction, so copied data can't be reused to clone a card. That's why counterfeit fraud collapsed once chip terminals became standard, and it's covered in more depth in our guide to what EMV is. Globally, the overwhelming majority of card-based transactions now run on EMV chip.

None of that helps online. In a card-not-present sale there is no chip to interrogate. The merchant has a number, an expiry date, a security code, and an address, all of which are static data that can be stolen and reused. That's the entire problem in one sentence.

The October 2015 US liability shift is where this became visible in the data. The Federal Reserve's last standalone payments fraud study found that accelerated adoption of chip authentication from 2015 to 2016 accompanied a reduction in the value of in-person card fraud, but that this reduction occurred alongside an increase in the value of remote card fraud (Federal Reserve, 2018).

The share numbers make it concrete. In 2015, remote fraud was less than half of all card payments fraud by value at 48.0%. By 2016 most fraudulent card payments by value were remote, at 61.1%, while most legitimate payments by value were still in person. That's a crossover in a single year.

Worth being careful about the causal claim, since the Fed was. It says the two things accompanied each other, not that one caused the other. The honest reading is that chip adoption made card-present fraud much harder while remote fraud kept climbing, and the balance tipped. Anyone telling you EMV simply pushed fraud online is stating more than the data does.

Also worth flagging: that study covers 2016. The Fed has not published an equivalent standalone card-present versus card-not-present fraud comparison since, so anyone quoting you a current federal figure for this is quoting a decade-old one.

What Closes the Gap Online#

Since you can't put a chip in a web form, the card-not-present channel needs different tools.

3D Secure is the closest equivalent. It authenticates the cardholder with their issuing bank before authorization, and a successfully authenticated transaction generally shifts fraud liability to the issuer. Visa reports that authenticated transactions show roughly a 45% reduction in fraud, at 11 basis points against 20 basis points for non-authenticated e-commerce, and a 9% lift in authorization approval rates (Visa). Treat those as Visa's own numbers for Visa's own product, but they're network-published rather than vendor marketing.

In the EU, Strong Customer Authentication under PSD2 has been mandatory since September 2019 (European Commission, 2019). The US has no equivalent mandate, so American merchants choose whether and when to use it.

AVS and CVV checks are the baseline. They're weak on their own and strong as filters.

Tokenization protects stored card data, which matters enormously for recurring billing where you hold credentials on file.

Qualifying for better CNP programs is worth real money. Notice from the table above that CPS/e-Commerce Preferred Retail prices below CPS/e-Commerce Basic. Preferred programs carry qualification requirements, and the schedule itself doesn't spell them out, so this is a question for your processor rather than something you can look up. Most merchants never ask which program their transactions actually hit.

Why Underwriting Treats You Differently#

If you're a card-not-present business, your merchant account application gets read differently, and it's not arbitrary.

The acquiring bank carries the loss if you fail and disputes come in. A CNP business has higher expected dispute volume, no in-person identity verification at the point of sale, and often ships goods after the payment clears. That combination is why CNP merchants more often see reserves, lower initial limits, or placement in high risk categories.

It also raises the stakes on your dispute rate, since disputes are measured against your merchant ID and monitored by programs that don't care why your channel is riskier.

What to Actually Do About It#

• Stop keying cards that could be dipped. Same-day fix, roughly halves interchange on those sales.
• Ask your processor which CNP interchange programs you qualify for, and what data you'd need to send to reach the cheaper ones.
• Run AVS and CVV on every CNP sale, and decline mismatches on higher-value orders.
• Consider 3D Secure selectively on large or first-time orders rather than across the board, so you get the liability shift where it matters without the checkout friction everywhere.
• Fix your billing descriptor. A recognizable name prevents the disputes that CNP businesses accumulate simply from customers not recognizing a charge.

If you run both channels, price them separately in your own accounting. Blending them hides the fact that your online sales may be carrying a materially different cost and dispute profile than your counter sales.