Editorial · August 19, 2015
EMV Chip Card Liability Shift: What Merchants Must Know
EMV chip card liability shift rules start in October 2015, and Visa's date is October 1. The main rule decides who pays when a criminal uses a fake copy of a card in a store. Today the bank that issued the card usually pays that loss. After the date, the store, or the store's bank, may pay instead. That can happen when the store's terminal cannot process an inserted chip card and the fake was copied from a chip card.
EMV is the global standard behind chip cards. MasterCard, Discover and American Express also start in October 2015. Visa gives automated fuel dispensers two more years. Visa also says U.S. merchants are not required to support chip. But a store without it may carry the cost of counterfeit fraud.
How the liability shift works
For counterfeit cards, the side with the weaker technology generally bears the loss. Visa says that on October 1, 2015, the party that has not adopted chip takes on the liability for counterfeit fraud in stores. That party is either the issuing bank or the merchant. Visa's one-page guide gives three cases.
- A card with only a magnetic stripe is swiped at a magnetic stripe terminal. If the sale is counterfeit, the merchant is generally not liable, just like today.
- A chip card is used at a stripe-only terminal. If the sale is counterfeit, the merchant generally holds the liability, because the issuer invested in chip and the merchant did not.
- A customer uses a chip card at a chip-enabled terminal that the merchant has turned on. If the sale is counterfeit, the merchant is not liable, and the issuer keeps the risk.
If both sides have chip, or neither does, liability generally stays where it is today, with the issuer. Visa announced its plan on August 9, 2011. MasterCard, Discover and American Express followed with their own EMV announcements in 2012.
What the shift covers and what it skips
The main rule covers counterfeit cards. A criminal copies the data from a chip card onto a fake magnetic stripe card, the fake is swiped at a terminal that cannot process an inserted chip card, and the sale goes through. Then the store or its bank may be liable. The EMV Migration Forum, an industry group, lists nine networks that use this rule.
Some other fraud stays under the old rules. Visa says the shift does not apply to card-not-present sales. Those include phone, online and mail orders. The Forum says the counterfeit rule does not apply to contactless payments. And if a chip terminal cannot read the chip and the card is swiped instead, the issuer still bears the liability when the sale is flagged as a fallback and the issuer approves it.
MasterCard, Discover and American Express add a second rule for lost and stolen cards. It covers a stolen chip card that is set up to prefer a PIN over a signature. A store may be liable if its terminal cannot process an inserted chip card or cannot take a PIN. Visa says its shift covers counterfeit cards only.
Automated fuel dispensers, a kind of unattended terminal, get more time. Visa's 2011 bulletin left them out for two years because the petroleum industry faced challenges in upgrading its terminals. Visa's readiness guide says the shift reaches them, and ATMs, on October 1, two years after the main date. The EMV Connection milestones page lists the same two-year gap for MasterCard and American Express.
Do you have to upgrade?
Visa's readiness guide says merchants in the U.S. do not have to support chip. A chip card keeps its magnetic stripe, so a store without chip can still take swiped cards. GoChipCard.com, a site from the Forum and the Payments Security Task Force, says the stripe stays on the back, so customers can still use a chip card at a terminal that is not chip-enabled.
What changes is who carries the loss. The site says that from October 2015, liability for counterfeit fraud will move from issuers to merchants that have not made their in-store terminals chip-enabled. Visa also says each chip sale makes a one-time code, which it calls virtually impossible to replicate in a fake card. Other brands may have their own rules, so ask your acquirer, the bank that has a contract with your store to accept cards.
What a store can do now
Visa suggests that merchants contact their acquirer as soon as possible. Start by asking your acquirer or payment provider what it takes to be chip-enabled. Visa says your next move has a lot to do with your current point-of-sale system and whether you own or lease the equipment.
Next, check both parts of the terminal. A chip-enabled terminal has or connects to a contact chip reader, the kind where the card usually goes into a slot, and it runs an EMV application that can process chip sales. Visa urges merchants to turn chip on in the hardware and the software for every card brand they plan to take.
Ask about PINs too. Visa does not require PIN with chip, but PIN may matter for the lost and stolen rule at MasterCard, Discover and American Express, so ask your acquirer.
Then train your staff. A chip card goes into the reader and stays there until the terminal says the sale is done. Pulling it out early stops the sale. Staff should also make sure each customer takes the card.
Last, watch fallback swipes. Visa says they are allowed but should be monitored, since they may point to faulty equipment or a need for training. The Forum says its paper is not legal advice and urges merchants to check with their payment networks.