EMV liability shift: who pays for counterfeit fraud

The EMV liability shift is the card network rule that decides who pays when a counterfeit card gets through at a store's terminal. In the US, since October 1, 2015, the loss sits with whichever side didn't support chip technology: the bank that issued a credit or debit card without a chip, or the merchant whose terminal couldn't read the chip on the card in front of it. Read the chip and counterfeit fraud stays the issuer's problem. Swipe a chip card on an old reader and it can become yours.

Our explainer on what EMV is covers how chips work and where the shift came from. This is the merchant's deeper version: which fraud the rule covers, who pays in each card and terminal combination, the dates, how the rule shows up as a chargeback, and what to change at the counter. Rules are as of October 2026.

What fraud does the EMV liability shift cover?

Counterfeit cards used in person. That's the core of it. Visa's 2011 plan for the US described a liability shift for counterfeit card-present transactions. Mastercard's merchant EMV FAQ states the rule from its side: since the October 2015 shift, the party that doesn't support EMV, issuer or merchant, takes on liability for counterfeit card transactions.

Lost and stolen cards are covered only in narrower cases, where a network's own rules say so:

• Visa has a separate dispute condition, 10.2, for cards reported lost, stolen or never received. Its merchant dispute guide limits it to PIN-preferring chip cards, in situations such as a sale where the chip wasn't read, a chip sale at a reader that isn't EMV PIN-compliant, or an online-authorized chip sale without a PIN where full chip data didn't reach Visa.
• Mastercard's Chargeback Guide (Merchant Edition, May 2026) has a chip liability shift code for lost, stolen and never-received-issue fraud, 4871, next to 4870, its chip liability shift code for counterfeits.

The rule leaves plenty out. It doesn't touch online, phone or mail orders, because no chip meets a terminal in those sales; our guide to card-not-present transactions covers the rules that apply there. It doesn't help with disputes that aren't about fraud, such as "it never arrived" or "I was charged twice." And it doesn't move a loss to you when your terminal read the chip the way it was supposed to.

Who pays when a chip card meets your terminal?

Two questions settle it: did the card have a chip, and could your terminal read it? Visa's merchant resource library frames the test as cause. Whichever side, issuer or acquirer, caused a chip transaction not to happen is held responsible for the card-present counterfeit loss. The acquirer is your bank, so its share comes back to you under your merchant agreement.

The table follows Visa's dispute conditions as its merchant guide describes them. Mastercard's FAQ states the same counterfeit rule, but its lost-card conditions are its own, so check its Chargeback Guide before you answer a Mastercard case. One situation isn't in the table (a chip that fails, so the terminal falls back to the stripe), and it gets its own section below.

When did the EMV liability shift start, and what came later?

October 1, 2015, for in-store terminals. Visa set that date in its 2011 announcement, and Mastercard's FAQ calls October 1, 2015 the fraud liability shift date for cards and POS devices, adding that the date is aligned across all of the major payment brands.

Fuel pumps got more time, more than once:

Visa's 2011 plan set the first pump date of October 1, 2017. A later Visa bulletin, U.S. Automated Fuel Dispenser EMV Liability Shift Delayed, moved it to October 1, 2020, and Visa then set April 17, 2021. Mastercard chose April 16, 2021. Both pump dates are more than five years behind us, so a station whose pumps read only the stripe is carrying the same exposure as a store without a chip reader. Our automotive page covers payment setups for fuel and auto businesses.

Is the rule still live in 2026? Yes. Visa's public rules dated April 18, 2026 still list both EMV liability shift dispute conditions, and Mastercard's May 2026 Chargeback Guide still carries its chip liability shift codes. The rule applies to card-present merchants in every state, so nothing here changes from one part of the United States to another.

How does the liability shift show up in a chargeback?

As a fraud chargeback whose reason code names it. On Visa it's condition 10.1, EMV Liability Shift Counterfeit Fraud, or 10.2 for the non-counterfeit version. On Mastercard it's 4870, Chip Liability Shift, or 4871 for lost, stolen and never-received-issue fraud. Our list of chargeback reason codes puts them next to the other fraud codes.

Visa's merchant guide spells out when an issuer can file a 10.1:

1. The sale was card-present.
2. The card used was reported as counterfeit.
3. The sale qualifies for the EMV liability shift.
4. The card is a chip card.
5. The sale didn't take place at a chip-reading device.

Condition 5 is the one you control. If your transaction record shows the chip was read, the sale happened at a chip-reading device, and that record is what your processor needs from you. Beyond that, the remedies Visa's guide lists for a 10.1 are narrow: documentation of a credit or reversal, and a letter from the cardholder saying they no longer dispute the charge. Its prevention advice is just as plain: use an EMV-compliant terminal, and get the right cardholder verification method, such as a signature or PIN. For a 10.2, the defense the guide names is showing that the sale took place at an EMV PIN-compliant terminal.

When one of these codes lands, work through it in order:

1. Read the notice: the code, the amount and your processor's response date. Our guide to how a chargeback works explains the stages.
2. Pull the transaction detail from your processor's reports and check how the card was read: chip, tap, swipe or keyed.
3. If the chip was read, or the card was tapped, send that record through your processor.
4. If a chip card was swiped on a terminal that can't read chips, accept the chargeback and replace that terminal.
5. If the chip failed and the terminal fell back to the stripe, send the record anyway and ask your processor how fallback sales are treated on your account.

Visa also put a ceiling on repeat claims against one account. In 2016 it said that, effective October 2016, issuers would be limited to charging back 10 counterfeit transactions per account, after which the issuer takes liability for all fraudulent transactions on that account (Visa). Ask your acquirer whether that limit applies to the case on your desk. And if you answer a case and the issuer still disagrees, the next stage is pre-arbitration.

Does the EMV liability shift apply to tap and contactless payments?

A tap is chip technology too. EMVCo says EMV contactless payments generate a one-time security code for every transaction, the same idea as a dipped card, and that code is what makes copied card data hard to reuse at a terminal. Phone and watch wallets work the same way at the counter; our guides to NFC payments and whether tap to pay is safer explain how.

The catch is a reader that only takes taps. Apple's developer site says over two thirds of US credit and debit cards are issued contactless-enabled, which leaves plenty of cards that can't tap at all. At a tap-only reader, those customers end up swiping. Visa's 10.1 condition asks whether the sale took place at a chip-reading device, and Visa's Technology Innovation Program doesn't count contactless-only terminals in the US. We read both the same way: keep a chip slot next to the antenna. Visa's program can remove the annual PCI validation for merchants who qualify, as our page on PCI compliance for small businesses explains.

Picture a produce vendor at a Tucson farmers market who takes cards on a phone. Tap covers most customers. A small reader that takes chip inserts covers the rest, so nobody's card gets swiped or keyed at the stall. Clearo's mobile payments include tap to pay and mobile card readers for exactly that setup.

What happens with a swipe fallback?

Fallback is the swipe a terminal asks for after it fails to read a chip. It's legitimate when a chip is worn or damaged, and it's also the moment a sale loses the chip's one-time code.

How Visa's 10.1 condition is written matters here. As the merchant guide describes it, the condition needs a sale that didn't take place at a chip-reading device, and a fallback swipe on a chip terminal isn't the same as a swipe on a terminal with no chip reader at all. Don't treat that as protection, though. Ask your processor how fallback sales are flagged and authorized on your account, and watch how often they happen.

Habits that keep fallback rare:

• Let the terminal ask for the swipe. Staff shouldn't choose it.
• Try the chip twice, then offer tap, then ask for another card.
• Count fallback sales per terminal and per shift each month. A jump usually means a failing reader or a habit worth retraining.
• Give a card that fails on every terminal a second look, and check your devices for tampering. The signs of a doctored reader are in our credit card skimmer guide.

The stripe is on its way out anyway. Mastercard says newly issued Mastercard cards stopped needing one in most markets from 2024, and that no Mastercard credit or debit card will carry a stripe by 2033.

What should a merchant do about the EMV liability shift?

Make the chip the normal way every card is read, everywhere you take cards. This checklist covers the usual gaps:

1. Put a chip-capable terminal at every lane: front counter, back counter, patio, pop-up table and delivery van.
2. Make sure each one reads contact chips as well as taps, and ask whether it supports PIN entry, since Visa's 10.2 defense depends on an EMV PIN-compliant terminal.
3. Train staff to dip or tap first and never to swipe a chip card unless the terminal asks.
4. Never key in a card that's physically in front of you.
5. Keep terminal software current and retire devices your provider no longer supports.
6. Check each terminal's mix of chip, tap, swipe and keyed sales every month.
7. Pair the chip with encryption. EMV fights counterfeits; point-to-point encryption keeps card data unreadable on its way to your processor.

Our guide to credit card machines for small business lists the features to insist on. Every one of our POS terminals, countertop, wireless or portable, reads chip, tap and swipe and takes Apple Pay and Google Pay. Retailers can find the rest of the setup on our retail page.

What does one old terminal cost? A worked example

These numbers are made up to show the math. A hardware store in Grand Rapids runs three registers. Two read chips. The third, at the garden center, is a swipe-only unit kept for the spring rush. Over one season, two counterfeit chargebacks arrive on chip cards swiped at that register: $640 and $1,180.

• Sales taken back: $640 + $1,180 = $1,820.
• Chargeback fees, at a made-up $25 each: 2 × $25 = $50.
• Cash out the door: $1,820 + $50 = $1,870, and the goods those counterfeit cards bought are gone as well.

Both losses trace to one device. Get a quote for a chip-capable terminal and put it next to $1,870. The old register's cost doesn't stop after one season, either: every chip card swiped there keeps the risk on the store's side.

When doesn't the liability shift help you?

It's a strong rule with a narrow job. It won't help when:

• The sale is online, by phone or by mail. Fraud there runs on card-not-present rules, and tools such as 3-D Secure and address checks are what protect you.
• The dispute isn't about fraud. Late deliveries, refunds and quality complaints need receipts and policies, not chip records.
• A real customer claims fraud on a sale your terminal read by chip. The chip record helps, but it's still a dispute you have to answer.
• A lost or stolen card wasn't PIN-preferring. Visa's 10.2, as its guide describes it, is limited to PIN-preferring chip cards.

Your next step

If your statements show keyed or swiped sales you can't explain, or fraud chargebacks coded 10.1 or 4870, send us a recent statement for a free statement review. We'll mark the fraud-related charges and tell you what we'd change at the counter. To talk through a terminal for each lane, contact us.