Understanding card-not-present fraud and how to protect yourself

This is known as a card-not-present transaction, often shortened to CNP. It happens whenever you make a purchase online, over the phone or through an app without swiping, tapping or inserting your physical card. 

While digital payments offer convenience, criminals may attempt to steal card information and use it to make unauthorised purchases. Understanding how CNP fraud works can help you spot risks earlier and take steps to protect your money and personal information.
 

What is card-not-present fraud?

In South Africa, the move to digital payments has made everyday spending easier, but it has also created more opportunities for scammers to target online shoppers through phishing scams, fake payment pages, fraudulent online stores and stolen card details.

CNP fraud happens when criminals use stolen card details to make purchases remotely without needing the physical card.

Fraudsters may obtain card information through the following:

• Phishing scams: Fake messages that steal information
• Malware or spyware: Harmful software that steals information
• Card skimming: Copying card details from ATMs
• Social engineering scams: Tricking people into sharing information 
• Fake websites: Copied sites used to steal data
• Data breaches: Hackers exposing stolen personal data
• Unsafe public Wi-Fi networks 

Once criminals have enough information, they may attempt to make online purchases or fraudulent transactions using your card details. This is why awareness and careful online payment habits remain an important part of protecting your money and personal information.

See latest scams

How card-not-present fraud usually happens

CNP fraud often starts long before the purchase is made.  

A fraudster may get card details by the following means:

• Tricking someone into entering them on a fake website
• Intercepting information from a phishing email or message
• Stealing details from a compromised device
• Using malware to capture information typed into a phone or laptop
• Copying details from a saved card account that has been exposed
• Pretending to be a legitimate business and asking for payment details directly

Once the details are stolen, they can be used quickly, often before the real cardholder notices.

What information do criminals target?

When making online purchases, you’re typically asked to provide the following:

• Your card number 
• Card expiry date 
• Your card verification value (CVV/CVC), the 3 digits on the back of your card 

Some transactions may also require additional verification:

• One-time PIN (OTP) 
• Banking App approval 
• Push notifications 
• Biometric verification such as fingerprint or facial recognition 

These security measures help verify that it’s really you making the payment and its key to pay attention to these, particularly if there are any transactions not authorised by you. 

It’s important to remember that we will never ask you to share your OTP, password or PIN with anyone.

Where card-not-present fraud can show up

CNP fraud is not limited to one type of purchase.

It can happen when you do the following:

• Shop online
• Pay a deposit through a website
• Book travel or accommodation
• Order food or groceries through an app
• Sign up for a subscription
• Pay a service provider over the phone
• Buy through social media marketplaces or unknown sellers

This means it can affect everyday spending, not just big purchases.

Practical ways to reduce your fraud risk 

Shop on trusted websites

Before entering your card details online:

• Check that the website address begins with ‘https’ 
• Look for secure payment indicators 
• Verify customer reviews and contact information 
• Be cautious of deals that seem unusually cheap or urgent; if it is ‘too good to be true’, it often is 

If something feels suspicious, avoid proceeding with payment.

Avoid saving card details unnecessarily

While saving card details can be convenient, it may increase exposure if accounts or devices become compromised.

Only save payment information on trusted platforms you use regularly and update your security software on devices, consistently. 

You can add a layer of protection by using your Virtual Card. Learn more about Virtual Cards and how it can help protect you against fraud.

Enable transaction notifications

Banking App notifications and SMS alerts can help you identify suspicious transactions quickly.

Regularly reviewing your account activity can help you spot suspicious transactions easier.

Our MyUpdates feature helps you stay informed about activity on your accounts through SMS, email or in-app notifications. By enabling alerts for transactions and account activity, you can keep track of your banking in real time and spot suspicious activity sooner.

Be careful with ‘free trial’ sign-ups

Some free trials ask for card details upfront. That is not always a problem, but it is worth checking the following:

• The terms
• The renewal date
• Whether the business is legitimate
• How easy it is to cancel

If you sign up for a free trial or subscription after doing your checks, set a reminder so you don’t miss the first billing date, especially if you plan to cancel before charges begin.

If you’re using your Virtual Card, you can also secure your online transactions by enabling or disabling specific retailers. If you disable a specific online retailer, any future transactions from that retailer will be declined. Learn more about managing your online stores.