What the EMV Liability Shift Means for Chargebacks
The EMV liability shift is a 2015 card network rule that decides who pays when a counterfeit chip card is used in person.
If your terminal can't read a chip and a counterfeit chip card gets swiped, the chargeback is yours.
I've watched a merchant lose a fight over a card reader that never dipped the chip. Nobody questioned the sale itself. The rule below decided that dispute before the customer called their bank, and by the end you'll know what to send back.
Key takeaways
- Pull the terminal verification results for the disputed sale from your processor.
- Expect Visa codes 10.1 and 10.2, plus Mastercard 4870, on these disputes.
- Answer a 10.1 within 30 days, and a 4870 within 45.
- Send the application cryptogram and the authorization approval code to Visa.
- Dip every chip card, because one swipe reverts that sale to stripe rules.
- Read card-not-present rules instead for online sales, which this never covered.
Want these disputes flagged before they turn into chargebacks? See how alerts work.
What is the EMV liability shift?
The EMV liability shift is a US card network policy, in force since October 2015, that reassigned the cost of counterfeit card fraud. Before 2015, issuers paid for almost all of it, whatever the merchant's equipment could do.
The networks rewrote that split to speed up chip adoption. A merchant with a working swipe terminal had no money reason to replace it while somebody else covered the losses. So a merchant who waited now pays for the counterfeit fraud that happens while they wait.
The same logic runs in the other direction. An issuer who kept mailing stripe-only cards carries the loss when the merchant already paid for a chip reader. Both sides got a deadline with a bill attached.
The rule only covers counterfeit fraud on a card handed over in person. It leaves out every sale where a buyer types a card number into your checkout page. It also leaves out disputes about the product, the delivery, or a forgotten subscription.
Much of the fraud that stopped working at the counter after 2015 moved to exactly that channel.
When did the EMV liability shift take effect?
The US liability shift took effect October 1, 2015 for point-of-sale transactions, and each other channel got its own later date:
The dates track how hard the hardware is to replace. A store manager can swap a countertop terminal the same day, while a fuel dispenser or an ATM is bolted down, certified, and often owned by somebody else.
Ownership is the part that trips people up. The pump at a franchised gas station and the ATM in a hotel lobby often belong to a third party. The merchant whose name is on the sign may not control that upgrade at all.
Fuel pumps took the longest by years. Visa and Mastercard pushed their October 2017 date back to October 1, 2020, then again to April 2021. A retrofit at a gas station often means replacing the whole dispenser.
So you can clear the counter and still pay for fraud at an unconverted pump or ATM, once that channel's own deadline has passed.
How the EMV liability shift shows up as a reason code
Visa 10.1, Visa 10.2, and Mastercard 4870 are the three codes that carry liability-shift disputes. Each code points to a different thing that went wrong at the terminal, and each asks for its own evidence:
Mastercard's terminal setup reports are the piece merchants forget. They show the reader was EMV-capable on the day of the sale, which is the whole question a 4870 asks.
A 10.1 says the card itself was counterfeit. A 10.2 says a real card reached somebody who shouldn't have had it, and the chip read still decides who pays.
Say a 10.1 just landed in your dispute queue.
The code describes what the network found at the terminal. How the fraudster made that card is a separate question, and one common route is EMV-bypass cloning.
Your acquirer holds most of this evidence. Terminal verification results and the chip data field sit in their transaction log, so start there.
Nothing here is legal or compliance advice. These are the fields the networks usually ask for, and any single dispute can still go against you. Our guide to chargeback reason codes carries the full evidence list for every network code.
Our reason code lookup tool pulls up any code's evidence checklist directly.
What are EMV chips, and how do they block fraud?
An EMV chip is a small processor in the card that generates a single-use code for every transaction. A magnetic stripe carries the same static data on every swipe, which is why a copy of a stripe keeps working.
The chip runs an authentication routine with the terminal and produces a cryptogram tied to that one sale. The cryptogram covers the amount, the terminal, and a counter that never repeats. The issuer checks that value against what it expects for that card and that counter.
Steal one purchase's data and you hold a value the network rejects on its second use.
That is why the shift targets counterfeit fraud specifically. A cloned stripe carries everything a terminal needs to approve a sale, so the copy spends exactly like the original until somebody notices. A chip read leaves a thief with a code that already expired.
The chip only protects sales where somebody hands over a real card at a real reader. EMV SRC takes the same one-time-code idea online, under its own rules.
Who is liable when a liability-shift dispute happens?
Liability falls on whichever party brought the lesser technology to the sale. You pay if your terminal couldn't read a chip the issuer did put on the card. The issuer pays if they sent out a card with no chip and your terminal was ready for one.
The networks decide this one sale at a time. When a dispute comes in, the network checks what your terminal was certified to do against what the card carried that day.
Two sales at the same counter can split, because one card had a chip and the other didn't.
There's a third outcome merchants miss. Sometimes the card and the terminal both meet EMV rules and the sale still turns out to be fraud. That dispute runs under ordinary fraud rules, because the liability shift only settles a technology mismatch.
Read the code before you decide the shift is involved at all. Answering a different fraud code with terminal certification records burns the response window.
How to avoid liability as a merchant
Three things keep a liability-shift chargeback off your books, and all three have to hold on the same sale:
- Run a terminal your processor has certified for EMV, and get that certification in writing.
- Hold PCI PIN Transaction Security approval on that device, listed on the PCI Security Standards Council site.
- Dip every chip card, and ask your processor to disable magnetic-stripe fallback on chip cards.
A terminal can read a chip and still fail to produce a valid cryptogram, if your processor never certified it. The network then treats that sale as non-EMV, whatever the device cost you.
Certified hardware still lets a cashier swipe a chip card out of habit, and that one sale falls back under magnetic-stripe rules. Pull the swipe-count report from your processor each month and retrain any register showing chip cards in the swipe column.
The EMV kernel is the payment app running inside the terminal. An out-of-date one can undo the certification on hardware that was compliant the day you bought it. Ask your processor which version your fleet runs.
A certified terminal does nothing about the disputes that start after a sale clears, which is what chargeback prevention covers.
We send chargeback alerts from every provider, so a dispute reaches you while you can still refund it.
FAQ
What does EMV stand for?
EMV stands for Europay, Mastercard, and Visa, the three companies that wrote the original chip specification. EMVCo, owned by six card networks, maintains the standard now.
Can a fraudster clone or bypass an EMV chip card?
Attackers use a shimmer to lift chip data and re-encode it onto a magnetic stripe card, an attack called EMV-bypass cloning. It works only where a terminal still accepts the swipe, and copying the chip itself stays impractical.
Does the EMV liability shift apply to online purchases?
No. The shift covers card-present transactions only, so a disputed online order falls under card-not-present rules and a different set of reason codes.
What happens if I miss the reason-code response deadline?
The chargeback stands and the funds stay with the issuer. Networks treat a missed window as an accepted loss, and that decision is final once it closes.
