Payments1 min read
Card-not-present fraud patterns, 2024
What the year's CNP fraud looked like — signal patterns, response effectiveness, and where the loss actually landed.
The card-not-present fraud picture in 2024 confirmed a trend that had been building since 2022. The story isn't "fraud is up"; it's that the shape has shifted enough that some historical defences degraded in effectiveness.
Based on merchant fraud reviews Q3–Q4 2024; written November 2024.
What shifted
Three observations from the year:
- Account-takeover-driven CNP is a larger share. A meaningful portion of what merchants labelled "CNP fraud" in 2024 was actually account takeover of the customer's account with the merchant — the card was valid, the user was valid, the account was compromised.
- BIN attacks are more sophisticated. Small-value probing at scale against merchants with poor rate limiting continued to work. The mitigation is basic — you can't run a merchant checkout without per-BIN velocity rules — but a lot of merchants still don't.
- 3DS challenge fatigue. Issuers are increasingly triggering step-up authentication, and the friction it causes drives cart abandonment, which merchants then blame on the wrong thing.
What worked
- Device fingerprinting continues to earn its keep for the specific case of distinguishing an account owner from an attacker.
- Per-merchant velocity rules on card number and BIN caught the highest-volume attacks.
- Behavioural signals across sessions — not just within one — caught account-takeover patterns.
What didn't
- Static rule lists based on geography or issuer country. The signal was too coarse to be useful, and the false positive rate was high.
Fraud engineering in 2025 will look more like anomaly detection over identity signals than pattern matching against static rules.