A successful liability shift in payments means the financial responsibility for a fraudulent card transaction has moved from one party to another based on which side used the weaker security technology. In practice, that usually moves the cost of the fraud off the merchant and onto the card-issuing bank, or the other way around. The rules come from the card networks (Visa, Mastercard, American Express, and Discover), not from federal law, and they apply to both in-person and online transactions in different ways.
For a merchant, a shift that lands in your favor means the issuer eats the loss on a fraud chargeback. A shift that lands against you means you pay the transaction amount plus any chargeback fees, even though you had nothing to do with the fraud itself.
How the Shift Is Decided
The rule is simple: whichever party in the transaction chain has the weaker security bears the loss. Before these rules existed, issuing banks absorbed most counterfeit and stolen card fraud by default. The networks changed that by tying liability to technology adoption.
If an issuer gives a customer a chip card and the merchant processes it by swiping the magnetic stripe on an old terminal, the merchant takes the fraud loss. If the merchant has a chip terminal but the bank issued a card without a chip, the bank keeps the liability. When both sides are on the same level of security, the issuer generally stays responsible, the way it always did.
In-Store Chip Transactions
The in-store liability shift took effect on October 1, 2015, when the four major networks simultaneously activated new point-of-sale fraud rules. From that date, a chip card swiped at a magnetic stripe terminal shifts liability to the merchant. A magnetic stripe card swiped at a magnetic stripe terminal keeps liability with the issuer. A chip card dipped at an activated chip terminal also keeps liability with the issuer.1Visa. EMV Liability Shift – Why It Pays to Adopt New Technology The shift applies both to counterfeit fraud and to lost-or-stolen card fraud when a chip card is used at a non-chip terminal.2U.S. Department of the Treasury. EMV Liability Customer Toolkit
The Fallback Trap
One scenario catches merchants off guard. When a customer inserts a chip card and the chip fails to read, the terminal may prompt the cashier to swipe the magnetic stripe instead. The sale goes through, but the transaction is flagged in the processing data as a “fallback.” For liability purposes, the merchant is treated as though they processed the payment without chip capability, and the fraud loss falls on them.2U.S. Department of the Treasury. EMV Liability Customer Toolkit
Fraudsters know this. Some intentionally damage the chip on a stolen card so the terminal forces a fallback to the magnetic stripe, which is much easier to counterfeit. A high volume of fallback transactions is both a fraud warning sign and a liability exposure. Training staff to pause when a chip read fails, and to inspect the card rather than swipe automatically, can prevent losses the shift rules won’t cover.
How the Network Verifies the Shift
Whether a shift actually sticks depends on the transaction data captured at the moment of sale. When a chip transaction runs, the card’s embedded chip generates a unique cryptographic value called the Application Request Cryptogram, or ARQC. It’s built from transaction-specific data: the purchase amount, the terminal’s country code, the date, and an unpredictable number generated by the terminal. Because it changes with every transaction, a counterfeit card without a functioning chip can’t produce a valid ARQC.
The terminal also records Terminal Verification Results (TVR), documenting the security checks performed. When a chargeback dispute reaches the card network, it examines these fields to determine whether the chip was actually read or the transaction fell back to something less secure. If the metadata confirms a compliant chip read, the shift is validated in the merchant’s favor. If it shows a magnetic stripe read or a fallback, the merchant absorbs the loss.
Online Transactions and 3-D Secure
Card-not-present transactions follow entirely different rules. The in-store EMV chip shift does not apply to online, phone, or mail-order purchases.1Visa. EMV Liability Shift – Why It Pays to Adopt New Technology For e-commerce, the equivalent protection comes from 3-D Secure (3DS) authentication, branded as Visa Secure by Visa and Identity Check by Mastercard.3Visa. Visa Secure EMV 3-D Secure for Merchants
When a merchant implements 3DS, checkout routes a verification request to the cardholder’s issuing bank. Under the current version (3DS2), the issuer analyzes dozens of data points behind the scenes, including the shopper’s device, purchase history, and shipping address. Low-risk transactions clear through a “frictionless” flow where the customer never sees a challenge, yet the merchant still gets liability shift protection. Higher-risk transactions trigger a step-up challenge, usually biometric verification or a one-time passcode sent to the cardholder’s phone.
The important nuance: attempting 3DS authentication generally triggers the shift even when the cardholder’s bank doesn’t participate in the protocol. Under 3DS2 rules activated in April 2019, a merchant who initiates the authentication attempt receives fraud chargeback protection regardless of whether the issuer supports 3DS2. That was a meaningful improvement over earlier rules that left merchants exposed when issuers hadn’t enrolled.
Mobile Wallets and Tokenized Payments
Payments made through Apple Pay, Google Pay, and similar mobile wallets add another layer of security that affects who bears the loss. These wallets replace the actual card number with a device-specific token and require biometric authentication or a device passcode before authorizing the payment. Because the transaction includes both a unique cryptographic token tied to the device and proof that the cardholder physically authenticated, the networks generally treat these as strongly authenticated.
Google Pay explicitly supports liability shift to the issuer for transactions using Mastercard and Visa device tokens processed in its CRYPTOGRAM_3DS mode, where the payment credentials are cryptographically tied to the consumer’s device.4Google. Shift Liability to Issuer – Google Pay API Apple Pay achieves a similar result: its built-in biometric authentication satisfies strong customer authentication requirements, and if the issuer returns confirmation of successful authentication, liability stays with the issuer.
What a Successful Shift Does Not Cover
This is where merchants most often get burned. A successful liability shift protects against fraud-related chargebacks only. It does not shield a business from disputes where the customer claims the product never arrived, the item wasn’t as described, a recurring charge wasn’t canceled, or a promised credit was never processed. Those non-fraud chargebacks fall into separate reason code categories and follow their own dispute rules regardless of how securely the payment was authenticated.
Each network keeps distinct reason code categories for fraud versus customer disputes about goods and services. The shift only touches the fraud codes. The customer dispute codes are a completely separate fight, and having a chip read or 3DS authentication won’t help win one.
“Friendly fraud,” where a legitimate cardholder makes a purchase and then disputes it claiming they didn’t authorize it, sits in a gray area. If 3DS authentication verified the cardholder’s identity, the merchant has strong evidence to contest a fraud-coded chargeback. If the customer files the dispute under a non-fraud reason code instead, the shift offers no protection.
What It Means for Consumers
The liability shift is fundamentally a behind-the-scenes dispute between merchants and card issuers. As a consumer, your protections come from federal law, not from card network operating rules. For credit cards, the Truth in Lending Act caps your liability for unauthorized charges at $50, and in practice most issuers waive even that as a competitive perk.5GovInfo. 15 USC 1643 – Liability of Holder of Credit Card
Debit cards carry more risk. Under the Electronic Fund Transfer Act, your liability depends on how fast you report the unauthorized transaction. Notify your bank within two business days of learning about the loss, and your maximum liability is $50. Wait longer than two days but report within 60 days of your statement, and you could be on the hook for up to $500. Miss the 60-day window entirely, and the bank is not required to reimburse losses that occurred after that deadline.6GovInfo. 15 USC 1693g – Consumer Liability
When a successful shift occurs on your disputed transaction, it simply determines whether your bank absorbs the loss or passes it along to the merchant. Either way, you get your money back. The shift happens invisibly, and you won’t typically be told which party ended up paying.