The chargeback liability shift is the card networks’ rule, in force since October 1, 2015, that assigns counterfeit card-present fraud losses to whichever party — merchant or card-issuing bank — supports the weaker security technology. Visa, Mastercard, American Express, and Discover adopted it together to push the U.S. payments system onto EMV chip cards.1Mastercard. EMV/Chip Frequently Asked Questions for Merchants If you are a merchant, the rule decides whether a fraudulent transaction comes out of your bank account or the issuer’s.
The Basic Rule
The principle is simple: the party with the less secure technology absorbs the loss. Three scenarios cover most card-present cases.
A customer presents a chip card, but the merchant’s terminal has no chip reader and the cashier swipes the magnetic stripe. Any counterfeit fraud on that sale is the merchant’s problem. Flip it around: the merchant has a working chip terminal, but the bank never issued its cardholder a chip card and sent out magstripe plastic instead. Now the issuer pays.1Mastercard. EMV/Chip Frequently Asked Questions for Merchants When both sides support chip and the transaction still turns out fraudulent, liability generally stays with the issuing bank, which is where the risk sat before 2015.
The rule targets counterfeit fraud where a physical card or device is present at the point of sale. Lost-or-stolen fraud follows a similar structure but may layer in PIN-verification requirements that differ by network. When a merchant loses the dispute, the cost is the original transaction amount plus an administrative fee, typically $20 to $100 per chargeback. For a small business absorbing lost merchandise on top of that, the fees compound quickly.
Contactless and Mobile Wallets
Tap-to-pay cards, Apple Pay, and Google Pay run on the same EMV chip technology as an inserted card, and the networks treat them the same way for liability. If your terminal is EMV-capable and processes the tap correctly, counterfeit fraud liability sits with the issuer.1Mastercard. EMV/Chip Frequently Asked Questions for Merchants Mobile wallets also tokenize the account number, so the real card number is never transmitted during the sale.
Fallback Swipes
A fallback happens when a chip card is inserted into a chip-capable terminal but the chip won’t read. Maybe it’s scratched, dirty, or defective, and the terminal prompts a magstripe swipe to finish the sale. Who pays depends on why the chip failed.
When the chip on the card is the defective piece, the issuing bank generally bears the loss because its product failed. When the merchant’s terminal is the problem — a broken reader, a misconfigured setting, or a cashier who manually bypasses the chip prompt — the merchant absorbs the loss. Networks look at merchant-initiated fallback with suspicion because counterfeiters routinely present cards with intentionally damaged chips, hoping the clerk will default to swiping. Some issuers just decline fallback transactions outright rather than take the risk. The defensive move for merchants is to attempt the chip read multiple times before falling back, and to log every fallback with its reason code in case a chargeback shows up later.
Fuel Pumps: A Later Deadline
Automated fuel dispensers were not covered by the original 2015 shift because upgrading outdoor pump hardware is expensive and slow. The fraud liability shift for fuel merchants took effect on October 1, 2020.2Visa. Time to Upgrade to EMV at the Pump Since that date, fuel merchants without chip-capable pumps absorb counterfeit fraud losses, and in some cases all card-present fraud at the pump.
Pump terminals have their own configuration rules on top of the certification any indoor terminal needs. They must run as online-only, unattended terminals with a zero-dollar floor limit, so every transaction is authorized in real time regardless of amount. Because pumps are unattended, they must also support “No CVM” as a fallback verification method, and any station that wants PIN entry has to support both online and offline PIN. Terminal certification for pumps includes Level 3 testing with pre-authorization test cases specific to the AFD environment.3Discover Global Network. Best Practices for Processing Automated Fuel Dispenser Chip Transactions
Online Sales: Different Rules
The EMV liability shift only governs card-present transactions. For e-commerce and other card-not-present sales, there is no chip to verify, and by default the merchant carries the fraud liability.
3D Secure is the online counterpart to the chip shift. It is an authentication protocol, branded “Visa Secure” by Visa and “Mastercard Identity Check” by Mastercard, that adds a real-time identity check during checkout. When a transaction is successfully authenticated through 3D Secure, liability for fraud chargebacks shifts from the merchant to the card issuer.4Visa. 3D Secure – Your Guide to Safer Transactions The shift can even apply to “attempted authentication” transactions where the merchant triggers the protocol but the issuer’s system doesn’t participate, though the specifics vary by network.
The current version, 3D Secure 2.0, runs behind the scenes for most sales. The issuer’s system evaluates device data, transaction history, and risk signals to decide whether the buyer looks legitimate. Low-risk transactions pass through in a frictionless flow the cardholder never sees. Higher-risk transactions trigger a challenge, usually a one-time passcode or a biometric prompt. If a merchant requests an exemption from authentication and the transaction goes through without a challenge, the liability shift does not apply. Skipping 3D Secure to reduce checkout friction trades chargeback protection for conversion rate, and that trade needs to be a deliberate one.
Being “Chip-Capable” Requires More Than a Chip Reader
Owning a chip reader is not enough to qualify for liability protection. The terminal and its software must pass formal certification.
EMVCo handles chip-specific certification in three tiers. Level 1 covers the physical and electrical interface between the card and reader. Level 2 covers the software kernel that processes the chip transaction. Level 3 covers end-to-end testing with live payment networks.5EMVCo. What Are EMV Level 1 and Level 2 Testing? EMVCo accredits independent labs to do the testing. A terminal that hasn’t passed all three levels won’t qualify for liability protection no matter how new it looks.
Separately, the PCI Security Standards Council sets requirements for how the terminal protects PINs and card data through its PTS Point of Interaction standard.6PCI Security Standards Council. PCI Security Standards Merchants can check the PCI SSC’s approved device listings to confirm their hardware still meets current requirements. Devices that reach their expiration date come off the list and have to be replaced even if they still work physically.
The POS software has to hold up its end too. The system must capture and transmit chip data fields during the handshake between the card and reader. Fields like the Application Identifier and Transaction Certificate must be populated to prove a real chip was present and authorized the sale. If those fields aren’t mapped correctly, the system can silently default to a magstripe transaction even when the chip was inserted, and the merchant loses liability protection without knowing it. Most modern POS providers ship pre-configured templates that handle the formatting, but it is worth confirming with your acquiring bank that your setup is properly certified and documented.
Debit Cards Add a Routing Wrinkle
Chip debit transactions come with federal routing rules that credit cards don’t have. Under Regulation II, the Durbin Amendment, every debit card must be configured to process transactions on at least two unaffiliated payment networks.7eCFR. 12 CFR Part 235 – Debit Card Interchange Fees and Routing (Regulation II) Issuers can’t restrict which networks are available, and networks can’t block merchants from picking the cheapest route.
You can route a chip debit transaction over the network with the lower interchange fee. But when a dispute arises, the chargeback has to be processed on the same network that handled the original sale.7eCFR. 12 CFR Part 235 – Debit Card Interchange Fees and Routing (Regulation II) Each network runs its own dispute rules and timelines, so the routing choice at the point of sale determines which set of chargeback procedures applies later. Some smaller PIN debit networks have thinner dispute infrastructure than Visa or Mastercard, and that can help or hurt depending on the case.
Fighting an EMV Chargeback
When a chargeback lands, your acquiring bank sends a notification, usually through an online dispute portal. Visa uses Visa Resolve Online (VROL), which manages the full dispute lifecycle from filing through resolution.8Visa. Visa Resolve Online Mastercard runs its own collaboration platform. Each notification carries a reason code that tells you exactly what type of fraud or dispute is alleged, and that code dictates what evidence you need.
Response deadlines vary by network. For Visa fraud and authorization disputes, merchants get 30 days to respond. Consumer disputes and processing errors also run on 30-day windows, with additional 30-day windows at the pre-arbitration stage.9Visa. Visa Claims Resolution – Efficient Dispute Processing for Merchants Mastercard gives merchants 45 calendar days from the settlement date for most transactions.10Mastercard. Chargeback Guide Merchant Edition Miss the deadline and you lose automatically, no matter how strong the evidence is.
For an EMV chargeback specifically, your strongest defense is proving a proper chip read happened. Upload the terminal’s transaction log showing that chip data fields were populated, the authorization code from the issuer, and any receipt showing the sale was processed as EMV. If the system logs confirm a successful chip transaction, the chargeback should reverse because you held up your end of the liability framework. Visa expects most disputes to resolve within 31 days, though cases that escalate to pre-arbitration or arbitration run longer.9Visa. Visa Claims Resolution – Efficient Dispute Processing for Merchants
One Thing the Shift Doesn’t Cover
Winning individual EMV disputes doesn’t protect you from network monitoring programs. Visa’s Acquirer Monitoring Program and Mastercard’s Excessive Chargeback Merchant program look at your overall dispute ratios across all reason codes, not just EMV-related ones. A merchant with clean chip compliance can still land in a monitoring program from friendly fraud, subscription billing complaints, or service disputes, and the fines and remediation costs there are separate from any single chargeback. Terminal security handles counterfeit fraud liability; keeping the total dispute ratio down is a different job that runs through fulfillment, customer service, and clear billing descriptors.