EMV Liability Shift and Fallback Transactions Explained

A liability shift is a card-network rule that moves the cost of a fraudulent card payment – usually by deciding who can be hit with the fraud chargeback – from one party to another, typically toward whichever side did not use the stronger security available. The EMV liability shift applies that idea to in-person chip cards: when a counterfeit copy of a chip card is used in person, the loss generally moves, in markets and transactions where the network applies the shift, to whichever side – the card issuer or the merchant’s acquirer – did not support chip.

A fallback transaction is what happens when a chip card is presented at a chip terminal but the chip cannot be used, so the payment is completed from the magnetic stripe (or, in some networks’ definitions, by keying the card number) instead. Fallback is the main legitimate route by which a chip card ends up as a magnetic-stripe transaction at a chip-capable terminal, so the networks write specific rules about who carries the fraud risk, how fallback must be flagged, and how often it may happen. This article explains both, with the network documents and dates behind each statement.

“Liability shift” in online payments is a different rule. The same phrase is used for card-not-present payments authenticated with 3-D Secure (Visa Secure, Mastercard Identity Check and similar). In the April 2026 Visa rules, for example, an issuer cannot raise a card-absent fraud dispute (condition 10.4) on an e-commerce transaction where the issuer confirmed authentication through Visa Secure with EMV 3-D Secure and the authorization carried ECI 5 and the authentication value (CAVV); an authentication attempt (ECI 6 with CAVV) is covered too, except for non-reloadable prepaid cards. Stripe’s documentation adds a practical caution: “Successful 3DS authentication doesn’t guarantee liability shift”, because network rules, fraud-monitoring programmes and dispute conditions still decide the outcome. The rest of this page is about the in-person, chip-card (EMV) counterfeit liability shift.

Scope. Liability rules differ by card network, region, country, transaction type and date, and they change. Everything below is stated “as published” in the document and edition named next to it – mainly the Visa Core Rules and Visa Product and Service Rules (18 April 2026 edition), the Mastercard Chargeback Guide (13 May 2025) and Transaction Processing Rules (10 June 2025), and U.S. Payments Forum guidance. The October 2015 U.S. date is history for one market, not a universal rule. This is an engineering explainer, not legal or contractual advice: merchants should confirm the rules that currently apply to them with their acquirer. Chip-level behaviour is defined in EMVCo specifications, which are not reproduced here.

What is a fallback transaction?

A fallback transaction is a chip-card payment at a chip-capable terminal that could not be completed with the chip and was finished another way – normally by swiping the magnetic stripe. It is meant to be rare, it must be flagged as fallback in the authorization message, and whoever approves it carries more fraud risk than in a chip transaction (see the liability matrix below).

Visa’s glossary treats fallback as a chip-card transaction first attempted at a chip-reading device, where the device could not use the chip, and which was then completed by some other way of capturing the card data. Mastercard’s chargeback guide defines technical fallback as a chip card at a hybrid (chip and stripe) POS or ATM terminal where the transaction ends up completed by magnetic stripe or by manual entry of the card number. The U.S. Payments Forum’s 2020 fuel-pump paper splits it into two kinds:

• Technical fallback – the terminal cannot talk to the chip at all, or cannot read it: no Answer to Reset (ATR), an invalid ATR, a faulty chip reader, or, early in a migration, cards inserted the wrong way round.
• Empty candidate list fallback – the chip responds, but none of the applications on the card matches an application identifier (AID) the terminal supports, so application selection finds nothing to run. (For how selection works, see the application-selection articles linked below.)

Fallback is not a valid way out of every failure. The same paper lists cases where it is not allowed after application selection has succeeded: the card or its only application is blocked; the chip declined offline (it returned an Application Authentication Cryptogram at the first GENERATE AC); the network does not support fallback; or the transaction ended abnormally, for example because the card was pulled out early. Visa’s acceptance-device rules list when a chip card must be completed from the stripe instead: the chip is not EMV-compliant, the reader is inoperable, the chip malfunctions or cannot be read, or there is no mutually supported AID. If neither chip nor stripe can be read, Visa says the merchant is not required to key the transaction.

The decision path, simplified from the U.S. Payments Forum descriptions, looks like this:

Chip card inserted at a chip-enabled terminal
 |
 +-- Chip answers (ATR received)?
 |     no  --> read the stripe as the card is removed
 |             service code says "chip" (first digit 2 or 6)?
 |               yes --> technical fallback, if the network allows it:
 |                       flag it as fallback, send for issuer authorization
 |               no  --> ordinary magnetic-stripe sale (NOT fallback)
 |     yes
 |
 +-- Any AID on the card that the terminal supports?
 |     no  --> empty candidate list: follow each network's rule
 |             (process as fallback, as plain magstripe, or terminate)
 |     yes
 |
 +-- Chip transaction runs
       chip error during processing    --> technical fallback may be allowed
       card/app blocked, offline       --> NO fallback; transaction ends
       decline (AAC), card pulled early

The principle: liability follows the weaker technology

A magnetic stripe holds static data, so a stripe that has been skimmed can be written onto a blank card. A chip card instead produces a fresh, one-time code for every transaction, which is why Visa’s U.S. merchant material describes chip cards as making in-store counterfeiting “virtually impossible” (Visa, EMV Liability Shift infographic, 2016). The protection only works if the chip is actually read and its data reaches the issuer.

In the U.S., the networks used the allocation of fraud losses as the incentive to adopt chip. Visa put it plainly when answering fuel retailers: the U.S. fuel-pump rollout was being “managed as a counterfeit fraud liability shift, not a mandate” (Visa, U.S. Automated Fuel Dispenser EMV Liability Shift Delayed, 2018). The same logic appears in the other U.S. announcements:

• American Express (29 June 2012) described its Fraud Liability Shift as moving liability for certain fraud types “away from the party that has the most secure form of EMV technology”.
• Discover (30 October 2012) called its policy “a risk-based payments hierarchy that benefits the entity that leverages the highest level of available payments security”.

A note on wording: Visa’s network rules allocate liability between the issuer and the acquirer, because those are Visa’s members. Visa’s merchant-facing material describes the same outcome as the merchant being liable. How an acquirer passes a dispute on to a merchant is set by the merchant’s own agreement, which is one reason the acquirer is the right place to confirm current terms.

Who bears counterfeit liability: a scenario matrix

The matrix below was built row by row from the network rules cited in each row. “Issuer” means the issuer keeps the counterfeit loss; “Acquirer” means the issuer can recover it through the network’s chip-liability dispute. Every row also assumes the network’s other conditions are met (fraud reported in time, cardholder denies the transaction, correct acceptance procedures, and the transaction falls in a market where the shift applies).

Two further Visa carve-outs in the April 2026 rules are worth knowing: the counterfeit liability shift does not apply where the authorization shows CVV verification was not performed or failed, and, for transactions not involving a Visa Europe member, where the transaction carried a token. Visa’s 2016 U.S. material also stated that the shift does not cover card-not-present transactions or lost-and-stolen fraud, which stay under the ordinary dispute rules.

The second hierarchy: lost, stolen and PIN

Counterfeit fraud is a copied card. Lost-and-stolen fraud is the genuine card in the wrong hands, and there the protection is cardholder verification – typically a PIN – rather than the chip’s one-time code. Some networks run a separate shift for it.

• Visa (dispute condition 10.2, 18 Apr 2026): for a PIN-preferring chip card, the acquirer is liable for lost, stolen or never-received-card fraud if the transaction did not take place at a chip-reading device, or was chip-initiated at a device that was not EMV PIN-compliant, or (for a chip transaction without online PIN that was authorized online) did not pass the full chip data (rules 5.8.2.5, ID# 0001838). The issuer is liable when a PIN-compliant device processed the chip transaction correctly (4.1.17.46, ID# 0001834). Fallback, contactless, ATM and Visa Easy Payment Service transactions cannot be disputed under 10.2. This condition applies only where Visa’s participation table includes it; the U.S. Region entry in that table lists counterfeit POS and ATM transactions, so do not assume a U.S. lost-and-stolen shift from Visa’s rules.
• Mastercard (reason code 4871, Chargeback Guide 13 May 2025): lost/stolen/never-received chip liability shift for PIN-preferring cards. For U.S. domestic transactions the guide gives 1 October 2015 excluding fuel dispensers and 16 April 2021 including them. Properly identified technical fallback is excluded, as are Mastercard ATM network transactions.

The U.S. timeline, by network and channel

The U.S. moved in stages, and the fuel-pump date moved twice. Dates below are as published by each network; “announced” rows were later superseded where noted.

Visa did not leave fuel pumps unmanaged during the delay. From July 2017 it ran a U.S. fuel-dispenser fraud-monitoring programme (VFMP-AFD) that flagged a merchant outlet when, in a month, it reached both $10,000 of domestic counterfeit fraud and a counterfeit-to-sales ratio of 0.20% (standard track) or 2.00% (excessive track); flagged outlets could then face counterfeit disputes. Visa ended the programme in May 2021, after the shift date.

Outside the U.S., at a high level

• Visa’s participation table (Table 1-12, April 2026) brings domestic, intraregional and interregional counterfeit POS and ATM transactions into the shift for its Asia-Pacific region (excluding domestic transactions in Mainland China), and POS and ATM transactions for its Canada, CEMEA, Europe and Latin America & Caribbean regions, each with footnoted exceptions. Read the table itself for any specific market.
• Mastercard’s domestic table (Chargeback Guide, May 2025, Single Message System chapter) shows how long some markets have been under a shift: Europe region from 1 January 2005 for all transactions, Brazil from 1 March 2008, Canada from 31 March 2011 for ATMs, and India from 31 December 2018 for ATM transactions.
• India: the Reserve Bank of India’s circular RBI/2015-16/163 (27 August 2015) required banks to make sure all active cards they issue are EMV chip-and-PIN cards by 31 December 2018. That is an issuance directive, not a liability rule. Separately, Visa’s rules require acquirers in India to use EMV-compliant devices with chip functionality activated and to deploy PIN pads (rule 5.8.2.6).

Some markets are much stricter about fallback itself. Visa requires issuers to decline domestic chip fallback in Canada, and domestic and intraregional fallback in its LAC region, except Puerto Rico and the U.S. Virgin Islands (ID# 0029999). Mastercard requires issuers in its Canada, Europe, LAC and Middle East/Africa regions to decline technical fallback when the merchant is in one of those regions. In Mastercard’s Europe region, chip-capable ATMs may not fall back at all, and POS fallback must use PIN. Visa’s acceptance-device table says unattended terminals in the United Kingdom must not process fallback.

How the service code tells the terminal there is a chip

The magnetic stripe carries a three-digit service code. Mastercard’s chargeback guide treats a card as a valid EMV chip card when the first digit of that code is 2 or 6 (the service code chart explains all three digits). That digit is how a chip-enabled terminal knows that a swiped card should have been inserted, and it is one of the values issuers and networks use to classify a transaction. The U.S. Payments Forum lists, network by network, the combination they check: typically the POS entry mode, the card’s service code and the terminal’s entry capability, with some networks also looking at chip data in field 55.

That combination is also where many “fallback” problems really come from. The Forum’s guidance describes terminals whose hardware could read chips but whose EMV software was not yet enabled or certified, while the messages already reported chip capability. Every swipe from those terminals then looked like fallback, and the Forum reported fallback rates above 50%, and sometimes 100%, at U.S. locations after the October 2015 shift. Its fix is to report the capability the terminal actually has in both hardware and software, and to mark magnetic-stripe-only cards on EMV terminals as ordinary stripe transactions, never as fallback.

The service code also explains row 8 of the matrix. A counterfeiter who copies stripe data onto a blank card and alters the service code so the card no longer claims a chip can avoid a “please insert” prompt. Both Visa and Mastercard exclude that case from the chip-liability dispute, which leaves the loss with the issuer that approved it.

Why networks treat fallback as high risk

• It can be induced. The U.S. Payments Forum notes that a fraudster may deliberately damage the chip on a counterfeit to force a stripe read.
• The issuer carries it. Because a correctly flagged, issuer-approved fallback stays with the issuer (row 6), issuers may simply decline fallback authorizations – and some markets require them to.
• Rates are watched. The Forum’s December 2016 guidance said the networks regard a fallback rate above 2% at a merchant or chain as a sign of a problem, that rates are under 1% globally, and that networks were urging strong action on U.S. acquirers above a typical migration rate of 7–10%. Mastercard’s U.S. region rules (June 2025) set a ceiling: technical fallback at a merchant location or ATM must not exceed 5% of its chip-card transactions in a calendar month, or the acquirer may face noncompliance assessments.

Fallback, key entry and plain magstripe: the differences

Reducing fallback: a checklist for merchants and integrators

These points come from the U.S. Payments Forum’s fallback guidance (December 2016) and its fuel-dispenser paper (June 2020):

1. Load every AID you accept. Some networks use more than one AID; a missing one turns into empty-candidate-list fallback.
2. Report real capability. The terminal entry capability should reflect hardware and enabled software, per network. If a phased rollout overrides the chip for some cards, the identifiers must switch back to stripe for those transactions.
3. Monitor by location, device and staff member. Network and processor reports may not be detailed enough to point to a single terminal.
4. Read device error logs for intermittent reader faults.
5. Train staff to follow terminal prompts and to swipe after a chip failure rather than key the card.
6. At fuel pumps, combined readers make chip errors look different from indoor terminals. The Forum notes that some merchants send fallback inside to the attended POS for networks whose pump fallback liability rules are less favourable.
7. Ask your acquirer which fallback indicators, rate thresholds and dispute rules apply to you today.

Frequently asked questions

What does liability shift mean?

In card payments, a liability shift is a rule that moves responsibility for a fraud loss – and the right to charge it back – from one party to another when a specified security step was or was not used. In person, the step is reading the chip (the EMV liability shift); online, it is usually 3-D Secure authentication, which follows separate rules.

What is the EMV liability shift in simple terms?

It is a network rule that moves the cost of card-present counterfeit fraud to the party that did not support chip. If the issuer gave out a chip card and the merchant’s terminal was not chip-capable, the acquirer – and, as Visa’s merchant material puts it, generally the merchant – can be charged back. If both sides used chip correctly, the issuer keeps the loss.

Who is liable for a fallback transaction?

Under Visa’s rules (April 2026), a fallback the issuer approved, flagged correctly in the authorization and handled with correct acceptance procedures is the issuer’s liability. If it was not authorized by the issuer, or was sent without the fallback indicators, it is the acquirer’s. Mastercard likewise excludes properly identified technical fallback from its chip-liability chargebacks.

When did the EMV liability shift happen for gas pumps?

In the U.S., Visa’s automated fuel dispenser shift took effect on 17 April 2021 and Mastercard’s on 16 April 2021. Visa’s earlier dates of October 2017 and October 2020 had been postponed.

Is swiping a chip card at a terminal without a chip reader a fallback?

No. Fallback requires a chip-reading device that tried and failed to use the chip. A chip card swiped at a stripe-only terminal is an ordinary stripe transaction, and it is exactly the case where counterfeit liability shifts to the acquirer side (matrix row 2).

What fallback rate is too high?

The U.S. Payments Forum reported that networks treat more than 2% at a merchant or chain as a sign of a problem. Mastercard’s U.S. rules set a hard limit of 5% of chip-card transactions per merchant location or ATM per calendar month.

Does the liability shift cover online purchases?

No. The EMV liability shift is about card-present transactions. Visa’s U.S. material states it does not apply to card-not-present transactions, and Mastercard excludes mail, phone, e-commerce and recurring transactions from its chip-liability chargeback.

Related reading on Ambimat

• Credit card service code chart – what each digit of the service code means.
• How an EMV contact card payment works, step by step
• EMV application selection: how a terminal discovers card applications
• Implementing EMV application selection
• List of application identifiers (AIDs)
• SDA, DDA and CDA: how chip cards prove they are genuine
• EMVCo L1 contactless reader design services – Ambimat’s reader design service page.

Sources

• Visa. Visa Core Rules and Visa Product and Service Rules, edition of 18 April 2026. Sections 1.7.4.4 (ID# 0029999), 1.10.1.2 Table 1-12 (ID# 0008190), 4.1.17.45–4.1.17.47, 5.8.2.2–5.8.2.6, Table 5-8 Acceptance Device Requirements, 11.7.2–11.7.3 (Dispute Conditions 10.1 and 10.2), 11.7.5.3 Table 11-28 (Dispute Condition 10.4 invalid disputes), Glossary “Fallback Transaction”. usa.visa.com
• Visa. EMV Liability Shift: Why it pays to adopt new technology (U.S. merchant infographic), March 2016. visa.co.id
• Visa. U.S. Automated Fuel Dispenser EMV Liability Shift Delayed (VBS 27.JULY.18), 2018. Pages 1–6. usa.visa.com
• Visa. Visa Fraud Monitoring Program Will Be Extended to Help Mitigate Counterfeit Fraud at U.S. Automated Fuel Dispensers, Visa Business News article AI10066, 4 June 2020. usa.visa.com
• Visa. Visa Announces Plans to Accelerate Chip Migration and Adoption of Mobile Payments, press release, 9 August 2011. investor.visa.com
• Visa. Visa Expands U.S. Roadmap for EMV Chip Adoption to Include ATM and a Common Debit Solution, press release, 4 February 2013. usa.visa.com
• Mastercard. Chargeback Guide – Merchant Edition, 13 May 2025. Chapter 2, “Chip Liability Shift (4870/70)” and “Chip Liability Shift – Lost/Stolen/NRI Fraud (4871)”; Chapter 3, Table 4 “Chip Liability Shift Program for Domestic and Intraregional Transactions”. mastercard.us (read via web.archive.org)
• Mastercard. Transaction Processing Rules, 10 June 2025. Chapter 1 “Chip Technical Fallback”; Europe Region rule 7.6; United States Region rule 4.1. mastercard.us (read via web.archive.org)
• U.S. Payments Forum. EMV Implementation Guidance: Fallback Transactions, Version 2.0, December 2016. uspaymentsforum.org
• U.S. Payments Forum. U.S. Automated Fuel Dispenser Chip Fallback Transaction Processing Best Practices, Version 1.0, June 2020. Sections 2–5. uspaymentsforum.org
• American Express. American Express Announces U.S. EMV Roadmap to Advance Contact, Contactless and Mobile Payments, press release, 29 June 2012 (as republished by the Secure Technology Alliance). securetechalliance.org
• Discover Financial Services. Discover Introduces Global Chip Card Fraud Liability Shift Policy Across Discover, Diners Club International and PULSE Networks, press release, 30 October 2012 (as republished by the Secure Technology Alliance). securetechalliance.org
• Reserve Bank of India. Security and Risk Mitigation Measures for Card Present and Electronic Payment Transactions – Issuance of EMV Chip and PIN Cards, RBI/2015-16/163, DPSS.CO.PD.No.448/02.14.003/2015-16, 27 August 2015, paragraph 5. rbi.org.in
• Stripe. Authenticate with 3D Secure, section “Disputes and liability shift”, Stripe documentation (accessed 10 October 2026). docs.stripe.com

Written by the Ambimat engineering team. Rules and dates are as published in the editions listed above; check with your acquirer for the rules that apply to you today.