Could a card be used without the physical card?¶

Yes. Card payments can be made without the physical card being present.

Avoid this assumption: Possession of the card proves who made every transaction, or that retaining the card rules out misuse.

Card details can be used online, by telephone, through a merchant account, with stored credentials or through a tokenised mobile wallet.

An offender may obtain the card number, expiry date and verification code through phishing, malware, data theft, skimming or access to the card.

A merchant may also retain a token for recurring or later payments.

A mobile wallet can continue to use a token linked to the card account even when the physical card is elsewhere.

This means the cardholder may still possess the card while unauthorised transactions occur.

Relevant records may show card-present or card-not-present classification, token use, merchant account, IP address, device, authentication method, billing details and delivery destination.

Ask the issuer whether the transaction used the physical card, stored card details or a digital token.

Ask the merchant for checkout, account, device, order and delivery records.

Do not assume that card-not-present activity is fraudulent. Legitimate online and recurring payments use the same route.

Equally, do not dismiss compromise because the card was never lost.

Preserve the physical card where relevant, but also preserve digital and provider records.

When reporting, distinguish the physical card, card details, token and card account.

Operational takeaway¶

Treat possession of the physical card as only one part of the evidence and establish whether the transaction used card details, stored credentials or a digital token.