EMV Liability Shift: Who Pays for Counterfeit Card Fraud?

On this page 7 sections

1. How the EMV Liability Shift Decides Who Pays
2. Who Pays, Scenario by Scenario
3. Counterfeit vs. Lost or Stolen: Where PIN Entry Matters
4. Fallback Swipes: The Gap in a Chip-Ready Store
5. Unattended Devices, Pumps and the Fraud the Shift Ignores
6. Prove Your Setup Before a Chargeback Does
7. Fight or Accept: Reading a Counterfeit Chargeback

Key takeaways

• An approval doesn't protect you. Visa lets issuers file a counterfeit chargeback on an approved sale if the chip wasn't read.
• Owning a chip terminal isn't enough. Your transaction record has to show a chip read with full chip data, so test every lane and integrated POS.
• Pull your entry-mode report. If it shows a dip or tap, fight the chargeback. If it shows a swipe or a keyed sale, accept it and fix the cause.
• PIN entry matters most where PIN debit is common, such as grocery and liquor lanes.

The EMV liability shift puts counterfeit card fraud on whichever side of the sale used the weaker technology. If a counterfeit copy of a chip card is swiped, hand-keyed or run on a terminal that doesn't read chips, the loss comes back to you as a chargeback. If your terminal read the chip and sent the chip data with the authorization, the bank that issued the card takes the loss.

Visa announced the shift in 2011, and it took effect for U.S. card-present sales in October 2015. Visa and Mastercard still enforce it through their own dispute codes. It is a card network rule, not a federal or state law. Nobody fines you for keeping a swipe-only reader. You pay for it one chargeback at a time.

How the EMV Liability Shift Decides Who Pays

A magstripe holds the same data on every swipe, so a skimmer can copy it onto a blank card. The chip creates a one-time code for each sale, and copied stripe data can't reproduce that code. Our explainer on how EMV chip cards work covers the technology in more depth.

The networks enforce the shift through fraud chargebacks with their own reason codes. On Visa, counterfeit cases fall under dispute condition 10.1 (EMV Liability Shift Counterfeit Fraud) and lost-or-stolen cases fall under 10.2 (EMV Liability Shift Non-Counterfeit Fraud). Mastercard uses 4870 (Chip Liability Shift), plus 4871 for lost, stolen and never-received cards. American Express and Discover apply their own chargeback rules.

Visa spells out exactly when a 10.1 applies. The sale was card-present, the card was reported counterfeit, the sale qualifies for the shift, the card is a chip card, and the sale didn't happen at a chip-reading device. Only the last condition is in your hands.

Many merchants believe an approval protects them. It doesn't, and that mistake is expensive. Visa's Dispute Management Guidelines for merchants say an issuer can file a 10.1 even when the sale was approved at the time, because an approval doesn't meet the EMV processing requirements. If a cloned card was swiped and approved, the loss is still yours.

Who Pays, Scenario by Scenario

The third and fourth rows catch merchants who think they finished upgrading years ago. Owning a chip terminal proves nothing in a dispute. The transaction record has to show a chip read with full chip data. That test fails if your integrated POS was never certified for EMV with your processor, or if your account is still set up to send swiped data.

A contactless tap from a chip card or phone wallet creates the same kind of one-time code as a dip, so it counts as a chip-grade sale. Tap-only readers cause a different problem. When a customer's chip card can't tap, staff end up keying the number. Our guide to NFC contactless setup and costs covers hardware that takes both taps and dips.

Counterfeit vs. Lost or Stolen: Where PIN Entry Matters

The chip stops cloning. It does nothing about a thief holding the real card. That second kind of fraud is what Visa's 10.2 and Mastercard's 4871 cover, and what decides it is whether your terminal takes a PIN.

Take a lost or stolen chip card that is set up to prefer PIN. If your terminal reads chips and supports PIN entry, the 10.2 conditions aren't met and the issuer keeps the loss. Run the same card on a chip reader with no PIN entry, and you've given the issuer the grounds for a chargeback.

PIN preference is far more common on debit cards than on U.S. credit cards. So for most merchants, lost-or-stolen risk is smaller than counterfeit risk. Grocery and liquor counters handle a lot of PIN debit and should take PIN at every lane, including self-checkout. Our article on whether your business needs a PIN pad lays out the hardware choices, and MannyPay carries PIN pads that accept chip and PIN debit.

Fallback Swipes: The Gap in a Chip-Ready Store

A fallback happens when a chip won't read and the terminal prompts for a swipe instead. Plenty are innocent: a scratched chip, a dirty reader, a card inserted backwards. Fraud rings know the pattern too. A cloned card with a dead chip pushes the terminal to the magstripe read the fraudster wants.

A failing reader that sends staff to the stripe creates exactly the swiped chip-card sales a 10.1 targets. A fallback that was properly flagged and authorized online may or may not leave you liable. That depends on the network and on how your terminal coded the sale, so get your processor's answer for Visa and Mastercard in writing. Other cases are clear. If a cashier swipes a chip card without a prompt, or keys the number at the counter, the loss moves to you. Restaurants run the same risk when servers take cards to a back terminal and swipe or key them. Handheld terminals for pay-at-the-table read the chip in front of the guest.

Here is how fast that adds up. The numbers are illustrative, not from a real store. Assume a liquor store's main lane has a worn chip reader, and cashiers now swipe whenever it hesitates. Over one month, four swiped sales turn out to be cloned cards. Each was a $300 purchase of high-end bottles, and the processor charges $25 per chargeback (each processor sets its own fee). The store loses $1,200 in merchandise (4 × $300) plus $100 in fees (4 × $25), or $1,300 in one month from one reader. A new reader ends the honest failures that taught staff to swipe. A firm rule for what to do after a second failure stops the rest.

That rule and the habits around it come down to three steps:

1. Insert or tap first, every time, and swipe only when the terminal asks for it.
2. After a chip failure, have the customer reinsert once. If it fails again, ask for another card or payment method instead of keying the number.
3. Pull a weekly report of fallback and keyed sales by register and by employee. If one lane or one cashier runs far above the rest, you have either a hardware problem or a staff problem. Our guide to preventing employee theft in a retail store covers the staff side.

Never use fallback or keyed entry to get around a decline. If the issuer declines, ask for a different card or payment method. Our breakdown of credit card decline codes explains the right response to each.

Unattended Devices, Pumps and the Fraud the Shift Ignores

Fuel pumps, ATMs and other unattended terminals got later liability shift deadlines than countertop terminals. Those deadlines have passed, so a magstripe-only pump now carries the same counterfeit risk as a counter. Self-checkout and kiosk lanes are easier targets because no one sees what gets inserted. If you're adding self-service, buy EMV-capable self-service kiosks that take chip and tap from the start.

Some fraud falls outside the shift entirely. Online, phone and payment-link orders never touch a chip, so use 3-D Secure authentication for those. Friendly fraud isn't a counterfeit case either: that's when the real cardholder disputes a purchase they made. A chip record proves the card was present, but receipts and a clear refund policy are what win those disputes. And no chip protects you from a breached network or a dishonest employee.

Prove Your Setup Before a Chargeback Does

Run a test sale on every terminal with a chip card and read the receipt. An EMV receipt shows the application identifier (AID) and an entry mode that indicates a chip read. Then pull a transaction report sorted by entry method. Our guide to reading your processing statement line by line shows where to find that detail.

If chip cards show up as swiped or keyed when staff swear they dipped, your setup is misconfigured. Ask your processor to confirm in writing that your account and any integrated POS are EMV-certified and sending full chip data. Keep firmware current, since outdated software causes read failures. Retire the old swipe reader in the drawer. If your hardware is aging, MannyPay offers chip-ready smart terminals and POS systems from Clover, Valor, Dejavoo and PAX.

Fight or Accept: Reading a Counterfeit Chargeback

Issuers have 120 days from processing to file a 10.1. Visa then gives you 30 days to respond, and Mastercard gives 45 days for a 4870. Those are network deadlines. Your processor's deadline will be shorter, and if you miss it you lose by default.

The entry mode on the transaction record tells you whether to fight.

1. Chip or contactless read, approved online. Fight it. Send the receipt, the processor's transaction detail with the chip's one-time code (the application cryptogram) and the authorization approval code, and one sentence stating the card was chip-read. Visa's fifth condition isn't met.
2. Swiped or keyed. Visa allows only narrow remedies for a 10.1: proof you already issued a credit or reversal, or a letter from the cardholder withdrawing the dispute. Accept the chargeback and spend your time fixing the cause. For a flagged fallback, ask your processor whether that network's rules give you a defense before you give up.
3. Recorded as a swipe, but staff dipped. Call your processor that day. Every chip sale since the setup went wrong carries the same risk.

One thing to do this week: pull the last 30 days of sales by entry mode and count the chip cards that were swiped or keyed at each lane. Any lane with a count above zero is where your next counterfeit chargeback is likely to come from. If you want a second set of eyes on your equipment and account setup, request a free quote from MannyPay, and a specialist will respond within one business day.

---

I fixed all four items:

• 2026 rulebooks: That claim is gone. The intro now says Visa announced the shift in 2011 and it took effect in October 2015. Both dates come from Visa's own press release, which I added to the sources list. I also dropped "Chargeback.io" style secondary sourcing for the date.
• "Leading cause" (table): The row now reads "You're exposed. Fallback swipes are a known source of 10.1 disputes," with no ranking.
• "One of the most common causes": Now reads "A failing reader that sends staff to the stripe creates exactly the swiped chip-card sales a 10.1 targets."
• 10-sale cap and October 2016 date: I removed the whole paragraph. I searched again and couldn't find a source for either the cap or the date, so I didn't keep the cap without the date.

Still to do: the 120-, 30- and 45-day deadlines come from the earlier draft's sources. They're worth checking against current Visa and Mastercard documents before this is published.

Sources

1. Visa Press Release: Visa Chip Card Migration and the October 2015 Liability Shift
2. Visa Dispute Management Guide for Merchants
3. EMV Liability Shift: Who Pays for Counterfeit Fraud (Clearo Payments)
4. What the EMV Liability Shift Means for Chargebacks (Chargeback.io)
5. Visa Reason Code 10.1: EMV Liability Shift Counterfeit Fraud (Verdikx)
6. Visa Chargeback Reason Code 10.1: EMV Liability Shift (ChargebackStop)
7. Visa 10.1 Chargeback (EMV Counterfeit Fraud): Guide (Chargemate)

AR

About the author

Adrian Reyes

Adrian Reyes is Senior Payments & Fintech Editor for Beyond the Swipe, covering credit card processing, merchant accounts, payment technology and processing fees.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.