EMV, the liability shift, and why it protects you.

What EMV is

EMV is the global standard for chip cards, named after the original consortium of Europay, Mastercard and Visa. The distinction from the magnetic stripe is not incremental.

A magnetic stripe holds static data. Every transaction transmits the same numbers, so anyone who captures them once can reproduce the card indefinitely. A chip generates a unique cryptogram for each transaction, a one-time code that authenticates that specific card, in that specific moment. Capturing it tells an attacker nothing useful about the next transaction.

This is why counterfeit card fraud collapsed at chip-accepting merchants and concentrated at the ones still swiping.

The liability shift

Before EMV, the issuing bank absorbed counterfeit fraud losses. The liability shift changed the default: whichever party is less EMV-capable now bears the loss.

In practice this means if you accept a chip card by chip, correctly, and it turns out to be counterfeit, the loss sits with the issuing bank. If you swipe a card that had a chip you could have read, the loss sits with you.

That is the entire commercial argument for chip acceptance, and it is a stronger one than most merchants realize.

Chip, contactless, and mobile wallets

Technical fallback

Sometimes a chip genuinely cannot be read, a damaged chip, a dirty reader, and the terminal falls back to the stripe. This is legitimate and occasionally unavoidable.

It is also a known fraud technique. Deliberately damaging the chip on a counterfeit card forces fallback to the stripe, where the counterfeit works. A sudden rise in fallback transactions at one location is a recognized fraud pattern, and it is worth monitoring rather than ignoring. If fallback is happening regularly at one terminal, the likeliest explanations are a reader that needs cleaning or replacing, or something you want to know about.

What EMV does not protect

Worth being precise here, because it is widely misunderstood. EMV protects against counterfeit cards in card-present transactions. That is its entire job.

It does nothing for card-not-present fraud, where the physical card is never involved. It does nothing about a genuine card that was physically stolen and used before it was reported. And it does nothing about friendly fraud, where the real cardholder makes a purchase and disputes it later. Those need address verification, security codes, clear billing descriptors, and good records, different tools for different problems.

What to check on your own setup

Confirm every terminal you run is EMV certified and that chip and contactless are both actually enabled, since contactless is sometimes shipped switched off. Train staff that dipping or tapping is the default and swiping is the exception, not a matter of preference. Watch your fallback rate. And keep readers clean, because a large share of fallback transactions are simply dirty contacts.

Common questions