PaysecVisit Website →
← Back to blog

EMV Liability Shift: What It Means for Your Business

October 24, 2026
EMV Liability Shift: What It Means for Your Business

The EMV liability shift is a card network rule that decides who pays when a fraudulent card-present sale goes through. In the U.S., the main in-person shift took effect on October 1, 2015. If a customer has a chip card and your terminal does not read the chip, the cost of counterfeit fraud can land on you instead of the card issuer.

This guide explains the rule in plain terms, shows which situations put liability on the merchant, covers contactless limits and online sales, and gives you a checklist to run at every location.

Paysec
Make Payment Costs More Transparent
PaySec offers Network Offset Pricing, detailed transaction reporting, and flexible payment options to help businesses address processing fees.
Explore PaySec

TL;DR

  • The shift is a payment-network rule, not a federal law. The party using the weaker technology in a counterfeit-fraud case can be held liable.
  • Owning an EMV terminal is not enough. The chip must actually be read, and staff must avoid unnecessary swipes and manual entry.
  • An approved authorization does not protect you from a later counterfeit-fraud dispute.
  • Contactless limits and liability treatment vary by network and terminal configuration, so confirm settings with your processor.
  • In-store chip protection does not cover online sales. Card-not-present payments need their own controls, such as 3-D Secure and tokenization.

Table of Contents

What the EMV liability shift is

EMV stands for Europay, Mastercard and Visa. Mastercard describes it as an open standard of technical specifications for chip cards and acceptance devices such as POS terminals, kiosks and ATMs.

The chip is the reason the standard exists. A magnetic stripe holds static data that a criminal can copy onto a counterfeit card. A chip contains a microprocessor that creates fresh data for each transaction.

The liability shift is the rule that gave merchants and issuers a reason to adopt the chip. According to the U.S. Payments Forum, network rule changes place liability for fraud on the party that has not adopted the stronger technology. The goal is to reduce card-present fraud.

Two points often get lost:

  1. Nobody was legally required to install EMV. The shift changed who absorbs certain fraud losses. It did not create a mandate.
  2. Liability did not move to merchants across the board. It moves in specific scenarios, mainly counterfeit card fraud, depending on what technology each side supports.

How liability is decided: technology matching

The U.S. Payments Forum describes a simple framework. Identify the type of fraud, then compare the technology the issuer and the merchant used. The party supporting the superior technology generally prevails for that scenario. If the technology is effectively tied, liability generally stays with the issuer.

Here is how that plays out in the most common counterfeit scenario:

CardMerchant terminal and processingWho generally bears counterfeit fraud
Chip cardChip read at an EMV terminalIssuer (technology tied)
Chip cardSwiped or keyed instead of chip-readMerchant or acquirer
Magnetic-stripe-only cardEMV terminalIssuer (the merchant has the stronger technology)
Magnetic-stripe-only cardMagnetic-stripe terminalIssuer (technology tied)

The table is a simplified view of counterfeit fraud. Network rules also address lost and stolen cards, contactless payments, ATMs and automated fuel dispensers, and the details differ by network. Treat the table as the principle, and check your acquirer's guidance for the exact rule that applies to your situation.

What puts liability on the merchant

Visa's merchant dispute guidance spells out the practical trigger. If a chip-enabled card is swiped or manually keyed instead of read by an EMV chip reader, the issuer may dispute the transaction even though it was authorized at purchase. For Visa's counterfeit fraud condition (10.1), liability may shift to the merchant.

Visa names the situations that can produce this dispute:

  • Unnecessary fallback to swipe. The terminal could not read the chip, and the cashier completed the sale with the stripe.
  • Chip present but not read. The card has a chip and the transaction was processed another way.
  • Magnetic-stripe processing on a chip-capable card.
  • Manual entry of a card that was physically in front of you.

Notice what these have in common. None of them is about the equipment you own. They are about how the transaction was handled at the counter, the table or the curb.

Authorization does not settle the question

A common assumption is that an approved sale is a safe sale. Visa's guidance points the other way: authorization shows the issuer approved the transaction at that moment. It does not show you followed chip-processing requirements, and it does not stop a later counterfeit-fraud dispute.

When you review a fraud dispute, the first question to answer is how the transaction was processed. Card-present with chip read, card-present with stripe, keyed, or online each follow different rules.

Why the chip is harder to counterfeit

The liability framework exists because chip data is hard to reuse. EMVCo's May 2025 security guide explains that the payment device responds to an unpredictable terminal number to create cryptograms, which the issuer can verify locally or remotely. Each transaction produces a one-time-use security code.

Chip creates a one-time code for issuer verification

In practice, a thief who captures the data from one chip transaction cannot replay it to build a working counterfeit card. A copied magnetic stripe has no such protection.

That protection has a boundary. The technology reduces counterfeit-card exposure. It does not decide every chargeback category, and it does not touch online fraud.

Fraud reason codes: do not assume a code means a shift

Merchants often see a chargeback notice and conclude the liability shift caused it. That is not always so.

Mastercard's Chargeback Guide lists message reason code 4837/37 as "No Cardholder Authorization", which is a fraud-related category, separate from product, service or processing disputes. The same guide has a separate chip liability shift section (reason code 4870/70) and a separate counterfeit-fraud section. So a code 37 dispute does not by itself prove that an EMV liability shift occurred.

What to do when a fraud chargeback arrives:

  1. Pull the transaction record and confirm how the card was entered: chip, tap, swipe, key or online.
  2. Match that entry method to the reason code in the notice.
  3. Check the current network guide, your merchant agreement and your acquirer's instructions. Chargeback rules are updated, and a static blog summary, including this one, should not replace them.
  4. Respond within the deadline your processor gives you, with the evidence the specific code requires.

Contactless and the "limit" question

Readers often ask what the contactless transaction limit is. In the U.S. there is no single number you can publish or configure and forget.

The U.S. Payments Forum states that contactless floor limits, cardholder verification limits, transaction limits, application identifiers and liability considerations vary by network and terminal configuration. Its 2020 paper noted that the U.S. contactless floor limit was set to zero for all networks at the time of publication, which meant online authorization was required. Parameters can change, so that is a data point from 2020, not a current setting.

Three terms help you talk to your processor:

  • Floor limit: the amount above which the terminal must go online to the issuer for authorization.
  • CVM limit: the amount above which the terminal asks for a cardholder verification method, such as a PIN or signature.
  • Transaction limit: the maximum amount the terminal will accept in a contactless transaction.

For a multi-location operator, the safe approach is to ask your processor to confirm the configured values for each network and each terminal model, then document them. Do not assume that a tap that worked at one location behaves the same on a different terminal.

If you want to offer tap-to-pay and mobile wallets, our contactless payment processing page covers tap, NFC and QR acceptance.

Online sales: a different channel, different controls

The in-store shift does not automatically protect a card payment made on a website or in an app. EMVCo describes EMV as covering more than the physical chip. Its specifications include contact and contactless chip, payment tokenization, QR codes, Secure Remote Commerce and EMV 3-D Secure. EMV 3DS is the companion technology for card-not-present transactions.

In short, chip controls protect face-to-face acceptance. Authentication and tokenization address remote risk. A business with both channels needs both sets of controls.

For online and subscription revenue, these PaySec guides go deeper:

What this means by business type

The rule is the same everywhere. The exposure points differ.

Restaurants and restaurant chains

The operational control that matters most is consistent chip insertion or contactless processing at every location. A terminal can support EMV while a workflow still creates risk. Servers who key in a card at the table, tableside handhelds set up incorrectly, and a drive-through lane with an older reader are typical weak points. Tip adjustments and pre-authorizations should also be tested, because the way card-present data is passed along matters.

Healthcare practices

Front desks take a mix of in-person cards, phone payments and portal payments. The in-person ones belong under chip and tap. The phone and portal ones are card-not-present and need separate controls. Keeping them separate in your reporting makes any later dispute much easier to answer.

Ecommerce and SaaS marketplaces

Your liability exposure sits mostly in card-not-present fraud. The in-store shift is not your protection. Authentication, tokenization and monitoring are. If you also take payments at pop-up events or in a showroom, treat that as a separate card-present channel with chip and tap enabled.

CBD and other high-risk retail

Counter sales should run on chip and tap like any other retailer. Disputes are costly in high-risk categories, so clean card-present data and a clear record of how each sale was entered are worth the discipline.

A location-by-location checklist

Use this list at each site, and repeat it whenever you add a terminal or change a point-of-sale setup.

  1. Confirm every terminal is EMV-enabled for contact and contactless, not only the main register.
  2. Check handhelds and mobile readers. Tableside devices and phone-based readers are often configured separately.
  3. Train staff on fallback. If the chip fails, the cashier should retry, try another entry method the terminal permits, or ask for another payment form before accepting a stripe swipe.
  4. Block unnecessary key entry for cards that are physically present.
  5. Review fallback and keyed rates by device. A single terminal with a high swipe rate usually points to a reader or configuration problem you can fix in a day.
  6. Ask your processor to confirm contactless settings for each network and terminal model, and record them.
  7. Separate card-present from card-not-present reporting, so each dispute is matched to the right rule.
  8. Keep dispute evidence ready: receipt data, entry method, terminal ID and timestamp.

Our guide on cutting EMV fallback risk with device-level monitoring shows how to find the terminals behind unnecessary swipes. If you are adding or replacing readers, going live with EMV on POS covers the integration steps.

Our perspective

We treat EMV liability as a transaction-processing question, not an equipment purchase. Merchants usually come to us after a chargeback, asking whether their terminals are "EMV compliant." The better question is whether the chip is being read on every card-present sale, at every location, by every employee.

Three habits separate merchants who rarely see counterfeit-fraud disputes from those who see them often:

  • They monitor at the device level. Fallback and keyed-entry rates by terminal show problems before the chargebacks arrive.
  • They match controls to channels. Chip and tap for the counter, 3-D Secure and tokenization for online and recurring payments.
  • They want to see their own data. Detailed transaction reporting shows how each sale was entered, which is the first thing needed to answer any dispute.

That is why we build merchant accounts with real-time reporting, PCI DSS Level 1 and SOC 2 compliance, and support that understands restaurants, healthcare, eCommerce, SaaS and high-risk verticals. Fraud controls are most useful when they run quietly in the background of everyday payments, and our fraud protection guide lays out how we think about the full picture.

— PaySec Marketing Team

Payment processing built for chip, tap and online

PaySec gives merchants one platform for in-store processing, an eCommerce gateway, mobile payments, recurring billing and fraud prevention. Pricing options include Network Offset, Flat Rate and Custom Enterprise, with no long-term contracts and no monthly minimums. Terminal placement is available at 0 $ per month.

Network Offset Pricing passes through true wholesale interchange rates, which makes costs easy to read on your statement. See how Network Offset pricing works, explore our merchant services, or review terminal placement to equip your locations with EMV and contactless readers.

FAQ

When did the EMV liability shift happen in the U.S.?

The main in-person shift took effect on October 1, 2015, according to the U.S. Payments Forum. It was a change in payment network rules. Rules for specific situations such as automated fuel dispensers and ATMs follow their own network schedules.

Am I liable if I do not have an EMV terminal?

You may be, in counterfeit-card scenarios. If the customer's card has a chip and your terminal cannot read it, the issuer can place the counterfeit fraud loss on the merchant or acquirer. Ask your processor which rules apply to your networks and transaction types.

Does the liability shift cover online purchases?

No. The in-store chip rule addresses card-present fraud. Online and other card-not-present payments rely on separate tools such as EMV 3-D Secure and tokenization, which EMVCo describes as part of the wider EMV specifications. Your processor can tell you how liability works for your online setup.

Does chargeback reason code 37 mean the liability shift applied?

Not necessarily. Mastercard lists 4837/37 as "No Cardholder Authorization", a fraud category. It also has separate chip liability shift and counterfeit-fraud sections. Check how the card was entered and which rule the notice cites before you respond.

What is the contactless transaction limit in the U.S.?

There is no single universal number. The U.S. Payments Forum says limits and verification rules vary by network and terminal configuration. Ask your acquirer to confirm the current values for each terminal you operate.

Sources