What is an online card payment?¶

An online card payment is a card-not-present transaction made through a website, application or other internet-based checkout process.

Avoid this assumption: The cardholder’s name and card details identify the person who made the purchase.

The merchant may collect the card number or token, expiry date, billing details, delivery details and account information.

The processor or issuer may record IP address, device or browser data, authentication events, risk decisions, transaction references and approval status.

A successful payment shows that the card route was accepted. It does not automatically prove who entered the details, who controlled the merchant account or who received the goods.

Stolen card details can be used online. A family member or employee may also use the card with permission.

A stored card or payment token may allow later purchases without re-entering the full details.

Strong customer authentication or one-time-passcode use may be relevant, but it still does not automatically identify the person who completed the step.

Preserve the merchant account, order ID, transaction reference, IP address, device information, billing and delivery details, timestamps and authentication records.

Ask the merchant for account creation, login, checkout, order, delivery and communication records.

Ask the issuer or processor for authorisation, authentication, token and risk records.

Compare the online activity with device evidence, emails, messages, location data and receipt of goods or services.

Do not assume that billing details identify the user. They may be copied, outdated or deliberately false.

When reporting, separate the card account, online account, device, delivery destination and actual user.

Operational takeaway¶

Use online card records to reconstruct the account, device, checkout and delivery chain before attributing the purchase to the cardholder.