A card holder can make purchases online only if the card product associated with their card supports it.
To block Internet-based purchases, ensure the config.poi.ecommerce field of your card product is set to FALSE.
For more information, see Card Products in the Core API Reference.