Introduction
Card not present (CNP) payments are transactions made without the customer physically using their card at the point of sale. Rather than tapping a terminal or entering a PIN, the customer provides their card details online, over the phone, or through securely stored payment information.
As ecommerce, remote services and subscription businesses continue to expand across the UK, card not present payments have become an essential way for businesses to take payments. They offer convenience and flexibility for both businesses and customers, but they also carry a higher risk of fraud and require stronger security checks.
Understanding how card not present payments work, along with the risks and best ways to manage them, is important for any business operating in today’s digital economy.
Taking Card Not Present Payments
For businesses of every size, the ability to accept card not present (CNP) payments has become increasingly important. In 2025, with digital transactions now a normal part of everyday commerce, face to face payments are no longer the only standard. Knowing how to take card not present payments securely and efficiently is essential for modern businesses.
A card not present payment happens when the customer is not physically present when the transaction takes place. Instead, they provide their payment details remotely through an online checkout, over the phone, or via securely stored payment information. These transactions are common across many sectors, including ecommerce, subscription services, hospitality and telephone sales.
While card not present payments offer convenience and flexibility for both businesses and customers, they also come with additional risks. Fraud, chargebacks and data security issues are more common in remote transactions than in person payments. This is why businesses need the right processes, systems and security controls in place, including compliance with standards such as PCI DSS.
In this guide, we’ll explain the main types of card not present payments, how they work in practice, and the steps businesses can take to improve security, reduce risk and create a better customer payment experience.
What is a Cardholder Not Present (CNP) Payment?
A card not present (CNP) payment is any transaction made without the physical card being used at a payment terminal. The card is not tapped, inserted or swiped. Instead, the payment is completed using manually entered or securely stored card details, usually including the card number, expiry date, CVV security code and billing address.
CNP payments are commonly used for online purchases, telephone payments and recurring subscriptions.
Because neither the card nor the cardholder is physically present, payment providers class these transactions as higher risk than face to face payments. To process them safely, businesses need additional verification checks and fraud prevention measures in place.
Common Ways to Take a Card Not Present Payment
There are multiple ways businesses can accept CNP payments & the best approach often depends on your industry, customer behaviour, and the nature of the services or products you offer. Below are some of the most widely used and effective methods.
Key Considerations
It’s important that your website uses a secure SSL connection and that your payment processor offers robust fraud screening and encryption. Consider implementing a payment gateway that includes 3D Secure authentication. Also, make sure your payment interface is mobile friendly, an increasing number of purchases happen on smartphones and tablets.
Online Payments, Website or App
With the digital economy thriving, online payments have become one of the most dominant and efficient forms of CNP transactions. They are particularly relevant for e-commerce retailers, online service providers, and businesses offering digital content.
How It Works
Customers typically visit your website or mobile app, browse your offerings, and proceed to checkout. At that point, they’re prompted to input their payment details, including their 16 digit card number, expiry date, and the CVV code. Some systems also offer the option of saving details for future purchases, provided that this is done in a secure, PCI compliant manner.
Accepted Payment Types
Businesses that take card not present payments can offer a wide range of payment methods to suit different customer preferences. These typically include debit and credit cards such as Visa, Mastercard and American Express, along with digital wallets including Apple Pay and Google Pay.
Flexible finance options can also be offered, including Klarna, Clearpay and PayPal Credit. Providing multiple payment types can improve the customer experience, increase conversions and reduce abandoned baskets at checkout.
Card Not Present Orders Over The Phone
Taking payments over the phone might seem old fashioned to some, but it remains an essential part of doing business in industries that offer personalised customer service or take bespoke orders, such as event planning, travel booking, catering, or healthcare services.
How It Works
The customer phones your business and provides their card details verbally. A staff member then manually enters this information into a virtual terminal or point of sale POS software that is configured to handle card not present transactions. Typical Use Cases are for businesses like Booking travel and accommodation, Reserving appointments or consultations and Taking deposits for services.
Things To Watch Out For
Your staff must be trained to handle sensitive card information with great care. Never write down card details on paper or store them on unsecured systems. Use virtual terminals that are PCI compliant and secure. If possible, record confirmation details and always follow up with an email receipt.
Payments Links & SMS Invoicing
Sending a customer a payment link via email or SMS is a modern and highly effective way to manage remote payments, especially useful for freelancers, consultants, and service-based businesses.
How It Works
You or your system generate a unique payment link, which is sent directly to the customer via email or text. When the customer clicks the link, they’re taken to a secure payment page where they can input their card details and finalise the transaction.
Advantages
This method gives the customer flexibility and confidence, especially if they want to complete the transaction at their own pace. It also helps streamline your invoicing process and provides a clear audit trail.
Security Tips:
Use payment platforms that offer 2FA (two factor authentication) or biometric verification options. And always ensure the link leads to a branded, encrypted site to avoid phishing concerns.
Subscription & Recurring Payments
If your business model relies on ongoing relationships with customers such as gyms, SaaS products, streaming services, or membership platforms then recurring payments are a powerful way to ensure continuity and reduce friction.
How It Works
After a customer consents to recurring billing, their card details are stored securely (usually tokenised), and payments are processed automatically at regular intervals (weekly, monthly, annually, etc.). Benefits are having a predictable cash flow, Improved customer retention, Reduced administrative overhead.
Caveats
Be transparent about your billing terms, renewal policies, and how customers can cancel. Automatically sending reminders or receipts each billing cycle can help reduce disputes or chargebacks.
Mail Order / Telephone Order (MOTO)
This more traditional method of accepting remote payments is still used by certain industries that require flexibility or operate in niche areas, such as hospitality, boutique travel, or B2B services.
How It Works
The customer sends their card details via post, fax, or over the phone, and the business inputs those details into a virtual terminal. This method is especially useful for companies with long-standing customer relationships and custom invoicing.
Drawbacks
MOTO transactions often bypass many of the fraud detection systems built into modern e commerce platforms. As a result, they pose higher risks and should only be used when absolutely necessary, and only with the appropriate safeguards in place. There is also a rise in businesses becoming victims of fraud due to card not present payments.
