Could a card be used without the physical card?¶

Yes. Stored details, online or telephone entry, merchant credentials and mobile-wallet tokens can produce payments while the physical card remains elsewhere.

Card account, details and instrument separate¶

Card number, expiry and verification data can be copied through phishing, malware, theft or access to the card. Merchants can retain tokens, and a provisioned wallet endpoint can transact without presenting the plastic card.

Possession therefore does not rule out misuse, while card-not-present status does not prove fraud.

Identify the actual route¶

Obtain card-present classification, token and stored-credential data, merchant account, endpoint, authentication, billing and delivery. Ask issuer whether physical card, details or token was used and merchant for checkout and fulfilment records.

Preserve the card where relevant but report physical card, account, details and token separately.