EMV processing is the global standard for accepting credit and debit card payments through an embedded microchip rather than a magnetic stripe. Named for Europay, Mastercard, and Visa, the companies that wrote the original specifications, the chip generates a unique cryptographic code for every transaction, so intercepted data cannot be reused. At U.S. merchants who fully adopted chip acceptance, counterfeit fraud fell 87% compared with the period before the rollout began in late 2015.1Visa. Visa Chip Card Update
How the Chip Protects a Payment
A magnetic stripe carries the same static account number on every swipe. Anyone with a cheap skimmer can copy it. An EMV chip works on a different principle. When you insert or tap the card, the chip and the terminal run a two-way authentication, and the chip produces a one-time code, called a cryptogram, tied to that transaction’s amount, time, and terminal. If a fraudster captures it, replaying it anywhere else fails: the network sees the duplicate and rejects it.
During the exchange, the chip also proves it is genuine using cryptographic keys burned into the hardware at manufacture. No readable version of the full account number crosses the connection. Cloning a magstripe takes seconds; replicating an EMV handshake is, in practice, not feasible with current technology. That is the entire reason in-store counterfeit fraud collapsed after chip adoption.
Contactless and Mobile Wallet Payments
Tap-to-pay uses the same chip security, transmitted over a short-range radio signal instead of through the card slot. The chip still generates a one-time cryptogram for that specific purchase.2EMVCo. EMV Contactless Chip Wireless does not mean weaker.
Phone-based wallets add authentication on the device side. Because the phone requires a biometric or passcode before it will transmit, mobile wallet transactions are generally considered more secure than a bare card tap. There is no single U.S. cap on contactless transaction size. Each network sets its own threshold for when the terminal must ask for extra cardholder verification. Visa does not mandate a verification limit on U.S. EMV terminals; Mastercard’s U.S. limit is $100. Under the threshold, the tap completes the sale. Over it, the terminal may prompt for a PIN.
Cardholder Verification
Once the chip proves the card is real, the terminal still needs to confirm the person using it is authorized. The chip carries a priority list from the issuing bank, and the terminal picks the strongest option both sides support.
Chip-and-PIN is the stronger method because it demands both the card and a secret code. A thief with the plastic alone cannot complete a PIN-verified purchase. Signatures offer almost no real security: they are easy to forge, and clerks rarely compare them. Most major networks dropped the signature requirement for chip transactions in April 2018. Many U.S. purchases below network thresholds now complete with no cardholder verification at all, leaning entirely on the chip’s proof that the card is legitimate.3Visa. EMV Chip Media Fact Sheet FAQ
The Liability Shift for Merchants
Before October 2015, banks absorbed almost all counterfeit-card losses at the register. The rollout changed that. Under the liability shift, whichever party has the weaker technology now pays for counterfeit fraud. Bank issues a chip card, merchant runs a swipe-only terminal: the merchant eats the loss. Merchant has a chip terminal, bank sent a stripe-only card: the bank eats the loss.4Visa. EMV Liability Shift
This is the financial stake that pushed U.S. merchants to upgrade. A business still running an old swipe terminal absorbs the full amount of every counterfeit chip-card transaction that passes through, plus chargeback fees that typically run $15 to $100 per incident, plus the lost merchandise. Merchants who accumulate excessive chargebacks can also be placed into card network monitoring programs, which add per-dispute fees and, in prolonged cases, can end with the loss of card acceptance entirely.
Where EMV Does Not Protect You
Chip security was built for one job: stopping counterfeit card fraud at a physical terminal. Two significant gaps remain.
Fallback Swipes
A fallback happens when a chip card gets swiped on the magstripe because the chip cannot be read, whether from a damaged chip, a dirty reader, or a terminal problem. These transactions skip the chip’s cryptographic protection and carry higher risk. Some issuers decline fallbacks outright. Merchants who see a lot of them should treat it as a signal that the chip reader needs attention. Excessive fallback rates draw scrutiny from processors and networks.
Card-Not-Present Fraud
The liability shift does not apply to online, phone, or mail orders, because there is no chip to read. On those transactions the merchant carries fraud liability by default. When a fraudulent order ships, the merchant loses the goods, refunds the cardholder, and usually pays a chargeback fee. Total cost per fraudulent online order often exceeds twice the transaction value. Fraudsters follow the path of least resistance, and EMV pushed that path online.
3D Secure, the protocol behind Verified by Visa and Mastercard Identity Check, exists to close this gap. When a merchant uses it, the issuer authenticates the cardholder during checkout, and liability on authenticated transactions can shift back to the issuer. For an online seller, 3D Secure is roughly the e-commerce counterpart to installing a chip terminal.
What You Owe if Your Card Is Used Fraudulently
Federal law caps consumer liability, but credit and debit cards are treated differently.
Credit Cards
Under the Truth in Lending Act, your maximum liability for unauthorized credit card charges is $50, and that only applies if the thief uses the card before you report it lost or stolen.5Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Once you notify the issuer, you owe nothing further. Every major network’s zero-liability policy waives even the $50 in most cases.
Debit Cards
Debit is riskier because the money is gone from your account the moment the charge posts. Under the Electronic Fund Transfer Act:
- Report within 2 business days of learning about the loss or theft: liability capped at $50.
- Report after 2 business days but within 60 days of your statement: liability capped at $500.
- Report more than 60 days after your statement: unlimited liability for unauthorized transfers occurring after that 60-day window.6Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Report a lost or stolen debit card the day you notice. With credit cards the legal urgency is lower, but prompt reporting still saves trouble.
What Merchants Need to Accept EMV
You need a terminal with a chip slot, a contactless reader, or both. Entry-level chip readers for small businesses start under $100. Mid-range countertop terminals with contactless run $150 to $600. Integrated point-of-sale systems for restaurants or multi-register retail run $400 to $900 per unit. Leasing spreads the cost but usually costs more over time than buying.
Hardware is not the whole picture. The payment software on the terminal must pass Level 3 testing, administered by EMVCo, which confirms the software handles chip data and the cryptographic exchange correctly.7EMVCo. What Is Level 3 Terminal Integration Testing Each card network layers its own certification on top, which is why deployment often takes longer than merchants expect. The terminal is linked to a Merchant ID and a Terminal ID that route settled funds to the right bank account.
EMV compliance and PCI DSS compliance are separate. A chip terminal does not satisfy PCI, and PCI does not substitute for chip acceptance. PCI DSS governs how you store, transmit, and protect cardholder data across your network. EMV governs the chip transaction itself. A merchant running a chip reader on an unsecured Wi-Fi network with default passwords has one box checked and the other wide open. Both apply.
Criminal Penalties for Card Fraud
Federal law treats counterfeit card activity as a serious offense. Under 18 U.S.C. ยง 1029, knowingly producing or using counterfeit access devices carries up to 10 years in federal prison for a first offense. Possessing or trafficking in device-making equipment carries up to 15 years. A second conviction under any part of the statute raises the ceiling to 20 years.8Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection With Access Devices Fines and forfeiture of equipment used in the offense apply alongside the prison exposure.