What is EMV? How chip cards stop counterfeit fraud

What is EMV? EMV is the global technical standard behind chip cards and the terminals that read them. When a customer dips or taps an EMV card, the chip creates a security code that's good for that one transaction only, which is why a thief who copies the card's data can't turn it into a working clone. The standard is maintained by EMVCo, a technical body owned by six card networks, and in the US the card networks pushed merchants to adopt it with a liability shift that took effect on October 1, 2015.

If you take cards in person, EMV affects two things you care about: how much counterfeit fraud you're exposed to, and which terminal you should be using. This guide covers both.

What does EMV stand for?

EMV originally stood for Europay, Mastercard, and Visa. EMVCo says the term came from those three companies, which developed the original chip specifications and formed EMVCo; Europay is now part of Mastercard. Today EMV is a registered trademark rather than an acronym anyone spells out.

EMVCo itself was formed in 1999 to manage the specifications, and it's collectively owned by American Express, Discover, JCB, Mastercard, UnionPay, and Visa. One detail trips people up: EMVCo writes the specifications and runs testing, but it doesn't mandate anything. Its own overview says it doesn't enforce EMV compliance or set implementation policies for issuers, merchants, and acquirers; those are handled by the payment networks. So when you hear about EMV "rules" like the liability shift, those come from the card networks, not from EMVCo.

EMV is also everywhere. EMVCo's figures put the number of cards using its specifications at 15.6 billion, and its worldwide deployment statistics say 97% of card-based transactions globally are EMV chip.

How does an EMV chip card work?

An EMV chip works by proving it's real with a code that changes every time. EMVCo explains that chip technology uses advanced cryptography to generate a one-time security code, called a cryptogram, for each transaction. That code lets the card issuer and the merchant's terminal authenticate the card, and because it's unique to each transaction, it can't be reused.

Here's what happens at the counter, step by step:

1. The customer inserts the card into the terminal's chip reader, or taps it on a contactless reader.
2. The chip and the terminal exchange the information the EMV specifications define for a payment.
3. The chip generates a cryptogram that's valid for this transaction only.
4. The terminal sends the transaction, including that cryptogram, through your processor to the card issuer.
5. The issuer checks it and approves or declines the payment.

Compare that with a magnetic stripe, which hands the terminal the same data every time it's swiped. Copy the stripe and you can copy the card. With a chip, copying the data isn't enough, because the copy can't produce a fresh cryptogram. When Visa laid out its US chip plan in 2011, it put it this way: even if payment card data is compromised, a counterfeit card would be unusable at the point of sale without the card's unique elements.

Why do chip cards stop counterfeit fraud?

Chip cards stop counterfeit fraud because a cloned card can't create the one-time code a chip terminal expects. Counterfeiting a stripe card only takes the data on the stripe. With a chip card, the data alone won't produce a card that passes at a chip terminal.

The results showed up once US merchants upgraded. In its December 2018 chip card update, Visa reported that for merchants who had completed the chip upgrade, counterfeit fraud dollars dropped 80% in the quarter ended September 2018 compared with the quarter ended September 2015.

EMV has limits, and it's worth being blunt about them. It protects payments where the card is physically present and the chip talks to a terminal. It does nothing for a card number typed into a website or read aloud over the phone, because there's no chip in that conversation. That's why online and phone payments rely on other tools, such as address verification, security code checks, and fraud rules. Our online payments setup includes those checks, and our guide to taking card payments on a phone covers the phone side.

What was the EMV liability shift?

The EMV liability shift was a change in who pays for counterfeit card fraud at the point of sale. Visa announced in 2011 that it would institute a US liability shift for counterfeit card-present transactions effective October 1, 2015. Under that plan, if a chip card is presented to a merchant that hasn't adopted chip terminals, liability for counterfeit fraud may shift to the merchant's acquirer, which is the merchant's side of the transaction.

It wasn't a fine and it wasn't a law. It was a reallocation of losses. Before the shift, Visa said in the same announcement, point-of-sale counterfeit fraud was largely absorbed by card issuers. Visa's merchant resource library sums up the rule: the party that is the cause of a chip transaction not occurring, either the issuer or the acquirer, is held financially responsible for the resulting card-present counterfeit fraud losses.

Fuel pumps got extra time. Visa's 2011 plan gave automated fuel dispensers until October 1, 2017, and that date was later pushed back. Visa ultimately moved the fuel dispenser liability shift to April 17, 2021, and Mastercard moved its fuel dispenser date to April 16, 2021.

A bit of history explains why the US needed a push. When Visa announced the plan in 2011, it noted that the US was the only country in the world that hadn't committed to a domestic or cross-border chip liability shift. The shift applied to card-present merchants across the US. Other payment rules, such as surcharging, vary by state, and our US locations hub breaks those down state by state.

Is contactless payment EMV too?

Yes. Tapping a card, phone, or watch runs on EMV's contactless specifications, and it uses the same one-time-code idea as dipping a chip. EMVCo describes EMV contactless as supporting in-store payments with contactless chip cards and NFC-enabled mobile devices that don't need physical contact with the terminal, and it says a one-time use security code is generated for every transaction to safeguard against fraud.

For merchants, the practical point is that most customers can now tap. Apple's developer site notes that over two thirds of all credit and debit cards in the US are issued as contactless-enabled cards. Look for the contactless symbol on your terminal; EMVCo says it signals to customers that the terminal accepts EMV contactless payments. A terminal that only reads the chip slot leaves those customers digging for the card.

What do merchants need to do about EMV?

You need a terminal that reads chip and contactless cards, a team that uses it properly, and other protections for the payments EMV doesn't cover. Here's a checklist:

1. Use a terminal that reads chip cards and contactless payments. EMVCo runs testing and approval for EMV acceptance devices, so ask your provider whether your model is current and still supported.
2. Make chip and tap the default. If staff swipe chip cards out of habit, you lose the one-time code and take on the counterfeit risk the liability shift assigns to you.
3. Keep terminal software up to date, and replace devices your provider no longer supports.
4. Check terminals and PIN pads for tampering. Know what your devices look like, count them, and look for added parts or loose casings.
5. Pair EMV with encryption. EMV stops counterfeit cards; it doesn't, by itself, keep card data out of your systems. That's the job of encryption, ideally a PCI-listed point-to-point encryption solution.
6. Protect the channels EMV doesn't reach. Online and phone payments need address verification, security code checks, and fraud rules.
7. Ask about your liability in writing. If any lane or location still takes swipe-only payments, find out what that means for chargebacks before a counterfeit claim arrives.

Say you run a convenience store in Philadelphia with one modern terminal at the front counter and an old swipe-only unit at the deli counter. Every chip card swiped at the deli is a transaction where counterfeit liability can sit on your side. Replacing that one device closes the gap.

What should staff do when a chip won't read?

A chip can fail to read for ordinary reasons: a scratched or dirty chip, a card inserted the wrong way, or a card pulled out before the terminal finished. Train your team to work through it in this order:

1. Ask the customer to remove the card and insert it again, following the arrow on the terminal, and to leave it in until the screen says to remove it.
2. Offer tap instead. If the card or the customer's phone shows the contactless symbol, a tap skips the chip slot entirely.
3. Ask for another card.
4. Swipe only if the terminal itself prompts for it. A swipe after a failed chip read is called fallback, and it gives up the one-time code that makes the chip hard to counterfeit, so keep it rare and notice if the same customer keeps needing it.
5. If one terminal fails with card after card, the problem is the reader, not the cards. Call your provider before the weekend rush.

Does EMV work the same everywhere you take cards?

The standard is the same everywhere. The hardware that makes it work changes with where you sell.

• Restaurants: read the card at the table when you can. A portable terminal that takes chip and tap means no server walks away with a customer's card. Our restaurants page covers pay-at-table setups.
• Mobile and field businesses: card readers that pair with a phone read chip cards and taps too, and tap-to-pay apps on a phone accept the same contactless cards and wallets. Our mobile payments page covers both.
• Unattended and fuel: kiosks, vending machines, and fuel pumps have their own hardware and their own network timelines, as the April 2021 fuel dates above show. Ask your provider which rules apply to each unattended device.
• Online and phone orders: no chip is involved, so EMV doesn't apply. Those payments depend on the fraud tools described earlier.

Common EMV myths

A few misunderstandings come up again and again.

• "EMV makes my business PCI compliant." It doesn't. EMV reduces counterfeit fraud at the terminal. The PCI Data Security Standard still applies to how you handle card data, and our page on what PCI compliance requires of a small business covers it.
• "Chip cards can't be used for fraud." Stolen card numbers still work online and over the phone, where no chip is involved.
• "Tap payments skip the security of the chip." Contactless EMV payments generate a one-time code for every transaction too.
• "EMVCo will fine me if I don't upgrade." EMVCo doesn't mandate or enforce anything. The card networks' liability rules are what make an old terminal expensive.

Is your terminal ready?

If your terminal still asks customers to swipe, can't take tap payments, or hasn't had a software update in a long time, it's time to replace it. Our guide to credit card machines for small business lists the features to insist on, and our POS terminals page shows the chip, tap, and swipe terminals we provide.

While you're at it, check what you're paying to process. Send us a recent statement for a free statement review and we'll show you your effective rate and any fees that shouldn't be there, or contact us if you'd rather talk it through with a person.