The chip rule: whoever is less secure pays.
If a counterfeit card is used at a terminal that cannot read chips, the loss lands on the merchant rather than the issuer. That is the whole of the liability shift, and it still catches out businesses running old hardware.
What this page settles.
Three questions, in the order most people ask them.
What the shift actually says
Before chip cards, counterfeit-card fraud in a shop was almost always the issuing bank’s loss. A criminal cloned a magnetic stripe, used it at a till, the real cardholder disputed it, and the issuer ate the loss.
The liability shift changed the default. The rule, in one sentence: when counterfeit-card fraud happens at the point of sale, the loss falls on whichever party — merchant or issuer — has the less secure technology.
In practice that means:
The card has a chip and your terminal read the chip. You did your part. If the transaction turns out to be fraudulent, the loss is not yours.
The card has a chip and your terminal swiped it, because that is all your terminal can do. You are the less capable party. The chargeback is yours.
The card has no chip at all — rare now, but they exist. The issuer is the less capable party, and the loss is theirs even if you swiped.
It is a card network rule, not legislation. Visa, Mastercard, Amex and Discover each wrote it into their operating regulations, and it is enforced through the chargeback process: certain fraud reason codes simply become available against merchants who are not chip-capable. Chargeback reason codes.
What it does not cover
Three important limits, because the shift gets blamed for more than it does.
It does not cover card-not-present fraud. Online, phone and keyed transactions were always the merchant’s fraud risk and remain so. Nothing about chip cards changed that, and no terminal upgrade helps with it. Selling online.
It does not cover disputes that are not counterfeit fraud. “Item not received”, “not as described”, duplicate charges, subscription disputes — all unaffected. Those are won or lost on your evidence. How to fight a chargeback.
It does not cover lost or stolen cards in every case. The shift is aimed at counterfeit. Lost-and-stolen liability depends on the network, the verification method, and whether a PIN was used, and the rules differ between them. A chip-and-PIN transaction puts you in the strongest position; chip-and-signature less so.
So the shift is narrow. It is also the narrow thing that most often costs a merchant running old equipment.
Fallback transactions, the real trap
A fallback is when a chip card is presented to a chip-capable terminal, the chip read fails, and the terminal falls back to the magnetic stripe.
This is legitimate — chips do fail, and readers get dirty — and it is handled differently from a terminal with no chip reader at all. But it carries two costs.
Fraud liability is murkier. Networks monitor fallback rates, and a terminal generating a high proportion of fallbacks looks either broken or deliberately degraded. Criminals have historically damaged chips specifically to force fallback, so high fallback rates attract exactly the attention you would expect.
Pricing suffers. A fallback transaction frequently sits at a worse interchange tier than a successful chip read. Downgrades.
What to do about it: if your fallback rate is noticeable, the reader is usually the problem. Clean the slot, check the firmware, and if it persists, replace the reader. A terminal that forces three fallbacks a day is quietly costing you money and raising your risk profile.
What this costs in practice
Two numbers make this concrete.
The liability itself. A counterfeit chargeback on a $400 sale costs you the $400 plus a chargeback fee of typically $15 to $35. Rare for most merchants — and when it happens to a non-chip terminal, it is entirely avoidable.
The pricing, which is the bigger number for most people. A swiped transaction and a chip-read transaction do not cost the same. Swiped card-present volume generally qualifies at worse tiers, and on a business doing $30,000 a month a 0.3% difference is $90 a month, every month. Over the life of a terminal that dwarfs the hardware.
So for most merchants the honest argument for chip hardware is not fraud liability. It is that you are paying more per transaction, forever, to use the old reader.
What to check on your own setup
Five minutes, and worth doing.
Can your terminal read chips, and does it? Capability is not the same as use. Terminals get configured to swipe-first, or staff get into the habit of swiping because it feels faster, and the chip slot goes unused.
Is contactless enabled? It frequently is not, on hardware that supports it. A tap is a card-present chip-grade transaction and the fastest option at the counter.
What is your fallback rate? Ask your processor. If it is more than a small percentage, something is wrong with the reader.
How often are cards keyed in person? Every keyed in-person transaction is a card-not-present transaction for pricing and for liability. If staff are keying because the reader is awkward, fix the reader.
Is your software current? Terminal firmware and POS payment modules get updated for network mandates. Out-of-date software can fail certification requirements and cause both pricing and liability problems.
Contactless and the same logic
Contactless transactions — tapped cards and phone wallets — use the same chip-grade cryptography as an inserted chip. For liability and for pricing, a tap is in the good category.
Which makes it the easy win. Enabling contactless on hardware that already supports it costs nothing, speeds up the counter, and keeps you on the right side of the rule. The same is true of acceptance on a phone, which is contactless by definition.
The thing that still catches people out is the mismatch: a business with a modern reader, contactless switched off, staff swiping out of habit, paying worse interchange on every sale and carrying liability it does not need to. That is a configuration problem, not a hardware problem, and it is free to fix.
What we charge
Interchange + 0.50% + 10¢ in person, interchange + 0.75% + 25¢ keyed, with no contract, no monthly fee and no monthly minimum.
Because we pass interchange straight through, the difference between chip-read and swiped volume shows up on your statement as the networks charged it rather than averaged away. Send us a page and we will tell you how your cards are actually being read.
While we are on the subject
Does the shift apply to online sales?
No. Card-not-present fraud liability already sat with the merchant and still does. The shift was about counterfeit cards used in person.
Is it a law?
No. It is a card network rule, set by Visa, Mastercard, Amex and Discover in their operating regulations, and enforced through the chargeback rules.
What if the chip fails and I have to swipe?
A genuine technical fallback is treated differently from a terminal that simply cannot read chips, but fallback transactions carry their own risk and their own pricing. See below.
Do I have to replace a working magstripe terminal?
Nobody will force you. You are simply accepting counterfeit-fraud liability that an EMV terminal would move off you, and paying worse interchange besides.