EMV Liability Shift: Who Pays for In-Store Fraud

What the shift actually covers in the United States

The phrase liability shift gets used as though it were one global rule. It is not. Visa publishes participation by region, and the regions differ in what kind of fraud they cover. In the US region the shift applies to all domestic and interregional counterfeit point-of-sale and ATM transactions. In the Canada, CEMEA, Europe and LAC regions it applies to all domestic, intraregional and interregional POS and ATM transactions covering counterfeit, lost, stolen and not-received-item fraud, with an exception for qualifying Visa Easy Payment Service transactions completed with a lost or stolen card or a not-received item. The practical reading for a US merchant is narrower than most people assume: the protection you gain by taking a chip transaction is protection against counterfeit card fraud. A lost or stolen genuine card used in your store in the US is not inside the US shift, and a dispute on it is argued on other grounds.

The three conditions, in the order they get missed

Visa states the counterfeit rule as a conjunction: a counterfeit card transaction completed in a card-present environment is the liability of the issuer if both the transaction takes place at an EMV-compliant chip-reading device, and, if the transaction is chip-initiated, it is correctly processed and — where authorised online — the authorisation request includes full chip data. Each half fails in a different way on a real counter. The device condition fails when a working chip reader has been bypassed, or when an old terminal is still in use somewhere in the estate. The correct-processing condition fails silently, in the integration: the terminal reads the chip, but the full chip data does not reach the network in the authorisation request because of how the POS or gateway assembles the message. That second failure is invisible from behind the till and shows up only when a dispute is lost. It is worth asking your processor to confirm, in writing, that full chip data is being transmitted on your card-present authorisations.

Fallback and key entry are two different problems

A fallback transaction is one where the chip could not be read and the magnetic stripe was used instead, with the terminal flagging it as such. Visa's rules make a fallback transaction the liability of the issuer if the transaction is authorised by the issuer or the issuer's agent, the appropriate values identifying it as a fallback transaction are included in the authorisation message, and correct acceptance procedures are followed. So fallback done properly is not automatically a loss — but it depends on the terminal setting the indicator, which is a configuration question rather than a staff one. Key entry is different and worse. Visa's dispute condition 10.3, Other Fraud – Card-Present Environment, exists for the case where the cardholder denies authorisation of or participation in a key-entered transaction conducted in a card-present environment. Typing the number in creates a dispute right that dipping the chip does not. Visa's schedule prices it worse too: CPS/Retail, Debit is 0.80% + $0.15 against CPS/Retail Key Entry, Debit at 1.65% + $0.15. If keying has become routine because a reader is unreliable, the reader is the first thing to fix on the list.

When the issuer cannot use the shift against you

Visa publishes a list of circumstances in which a dispute under condition 10.1 is invalid, and several of them are worth recognising on a dispute notice. A chip-initiated transaction is invalid ground. So is a fallback transaction, an emergency cash disbursement, and a mobile push payment transaction. So is a transaction for which the authorisation record contains POS entry mode code 90 while the service code encoded on the magnetic stripe does not indicate the presence of a chip — in plain terms, a stripe-only card swiped as a stripe card. So is a transaction where the authorisation request contained the CVV but either verification was not performed or the record indicates it failed. Outside Europe, a transaction that contained a token is also invalid ground. Before initiating the dispute the issuer must report the fraud activity to Visa using fraud type code 4, counterfeit. None of this is a defence you construct after the fact; it is a checklist for reading whether the dispute you received was validly raised in the first place.

The clock, and what it is measured from

Both card-present fraud conditions run on the same window. An issuer may initiate a dispute under condition 10.1, EMV Liability Shift Counterfeit Fraud, within 120 calendar days from the transaction processing date, and the same 120-day limit applies to condition 10.3, Other Fraud – Card-Present Environment. The date it runs from is the transaction processing date, not the date the goods left the shop and not the date the customer noticed. Your own response deadline is shorter and is set by your acquirer, so the operational rule is simple: the retrieval or dispute notice is the most time-sensitive piece of paper your business receives, and it should not sit in a pile. Build the evidence the day the notice arrives, because the terminal receipt, the chip data confirmation and the transaction log are all easier to retrieve in week one than in week six.

The disputes a chip card never protected you from

The most expensive misunderstanding about the liability shift is treating it as protection against disputes generally. It covers counterfeit fraud in the US region and nothing else. Every non-fraud dispute condition remains available to the issuer regardless of how the card was read. Condition 12.5, Incorrect Amount, covers a transaction amount that is incorrect or where an addition or transposition error occurred, with the dispute amount limited to the difference between the amounts. Condition 12.6 covers a single transaction processed more than once using the same payment credential on the same transaction date for the same amount. Condition 13.6, Credit Not Processed, applies where the cardholder received a credit or voided transaction receipt that was not processed; the issuer must wait 15 calendar days from the date on the credit transaction receipt before disputing, and must process the dispute within 120 calendar days of that date. Condition 13.3 covers merchandise or services not as described or defective. All of those are won or lost on your records and your policies, not on your card reader. This is general information about published card network rules, not legal advice (September 17, 2026).

A short list that actually reduces card-present losses

Five things, in the order they pay back. Confirm with your processor in writing that full chip data is transmitted on card-present authorisations, because that is the condition most likely to be failing without anyone knowing. Check that every device in the estate is an approved PIN transaction security device and is on current firmware; the PCI Security Standards Council publishes the approved device listings, and an unlisted or expired device is a problem long before a dispute arrives. Make key entry an exception that requires a supervisor, not a habit. Verify that fallback transactions are being flagged correctly in the authorisation message, since the rule's protection depends on it. And disclose your return and refund policy the way the rules require, because the disputes a chip card was never going to stop are the ones your paperwork has to.

About the rate tables on this page: Visa is the only card network that publishes a public US merchant interchange schedule, so the rate tables on this site are Visa-only. Mastercard, American Express and Discover do not publish an equivalent US merchant schedule, and their rates are neither shown above nor implied by these figures. Ask your processor for the rates that apply to each network on your account.