Successful Liability Shift: What Is Required for Enrolled Cards?

Payment card fraud represents a significant challenge within the financial system, impacting both consumers and businesses. When a fraudulent transaction occurs, determining which party bears the financial loss is a complex process. The payment ecosystem involves various entities, including cardholders, merchants, payment processors, and financial institutions, each with specific roles in securing transactions. Understanding these responsibilities helps clarify who is accountable for unauthorized charges.

The Concept of EMV Liability Shift

The EMV liability shift originated to combat counterfeit card fraud, which historically placed the burden of losses primarily on card-issuing banks. Before this shift, if a fraudulent transaction occurred using a counterfeit magnetic stripe card, the bank that issued the card absorbed the financial loss. This framework did not sufficiently incentivize the adoption of more secure payment technologies.

In October 2015, major card networks like Visa, Mastercard, American Express, and Discover implemented new rules to encourage the transition to EMV chip card technology. These rules shifted the financial responsibility for certain types of counterfeit fraud away from the party with the most secure technology. The core principle is that the party with the less secure technology in a transaction becomes liable for the fraud. This change aimed to accelerate the deployment of chip-enabled terminals by merchants and the issuance of chip cards by banks.

Key Requirements for a Successful Shift

For the EMV liability shift to occur successfully, specific conditions must be met during a transaction involving a chip card. The merchant’s point-of-sale (POS) terminal must be EMV-enabled, capable of reading chip cards. This terminal must also be actively used to process the transaction, rather than relying on the magnetic stripe reader.

The payment card itself must be an EMV chip card, containing the embedded microchip that encrypts transaction data. During the transaction, the card must be inserted into the chip reader, ensuring the data is processed through the chip rather than swiped via the magnetic stripe. This chip-based processing provides enhanced security features, making it significantly harder to counterfeit.

The correct Cardholder Verification Method (CVM) must be applied during the transaction. For cards configured as “chip-and-PIN,” the cardholder must enter their Personal Identification Number (PIN) to authorize the purchase. For “chip-and-signature” cards, the cardholder must provide a signature, which the merchant should verify against the signature on the card. All these conditions—an EMV-enabled terminal, an EMV chip card, chip processing, and proper CVM—must be fulfilled concurrently for the liability to shift away from the card issuer.

Implications of Non-Compliance

Failing to meet the EMV liability shift requirements can result in significant financial consequences for the non-compliant party. If a merchant possesses an EMV-enabled terminal but processes a chip card transaction by swiping the magnetic stripe, they may become liable for any resulting counterfeit fraud.

Conversely, if a card-issuing bank has not issued an EMV chip card to a cardholder, they may retain liability for counterfeit fraud even if the merchant has an EMV-enabled terminal. The financial burden of fraudulent transactions, which can range from tens to hundreds of dollars per incident, will then fall upon the entity that did not upgrade its technology or process transactions according to EMV standards.