How a card-not-present transaction works
The card details are typed in, taken from a stored credential or supplied by a wallet. Nothing reads the chip, so the checks are different: the card security code, the billing address, device and behaviour data, and 3-D Secure.
The Visa Core Rules of 18 April 2026 call this the card-absent environment. A transaction falls in it if the card and cardholder are not physically present at the merchant, if no acceptance device is used, or if a stored credential is used.
What EU law says about remote payments
PSD2 defines a remote payment transaction as one initiated via the internet or through a device that can be used for distance communication. Under Article 97, strong customer authentication for an electronic remote payment must include elements that dynamically link the transaction to a specific amount and a specific payee.
Why the category matters
Schemes, issuers and acquirers treat the two environments separately: fraud liability, dispute rights, fees and risk limits can all differ. A gateway is a card-not-present product by nature, and its fraud tools, authentication and tokenisation exist because the card cannot prove itself.
Card-not-present, card-present or MOTO?
- Card-present transaction
- The card, or a device carrying it, is read by a terminal. The chip produces a cryptogram that card details alone cannot.
- MOTO
- Mail order and telephone order: a card-not-present payment keyed in by the merchant's staff, not by the cardholder.
Where a card-not-present transaction shows up in a platform
Modules that do the work
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: glossary, Card-Absent Environment (Visa)
- Directive (EU) 2015/2366, PSD2, Articles 4(6) and 97(2) (EUR-Lex)
General information, not legal advice: what applies to you depends on your services and your market.