Skip to main content

EMV & Contactless (Operator Field Manual)

TL;DR
  • EMV chip liability shift is live. If your terminal can't read a chip, you're carrying the fraud loss on chip card transactions
  • Contactless (NFC/tap) uses the same chip security with tokenized credentials. It doesn't raise your fraud risk, whatever you've heard
  • Fallback to swipe when a chip fails is allowed, but it puts liability back on you. Don't let it happen except on a genuine terminal failure
  • Contactless spending limits vary by country (typically $50-$200 per tap). Over the limit and you're asking for a PIN or a signature

EMV chip cards shifted fraud liability to whoever didn't support the chip. Contactless adds speed without sacrificing security. Know the liability rules and keep your terminals compliant.

Last verified: Dec 2025. EMV mandates and contactless limits vary by region, so confirm yours with your acquirer. They aren't universal.

What Matters (5 bullets)​

  • EMV liability shift is live. Non-chip terminals bear fraud liability for chip cards.
  • Contactless uses the same chip security. NFC transactions get EMV protections.
  • Fallback to swipe creates liability. If the card has a chip and you swipe it, that's on you.
  • Contactless limits vary by region. Above-limit requires PIN or device auth.
  • Tokenized wallets (Apple Pay, Google Pay) are even more secure. Device-bound, biometric.

EMV Chip Basics​

How EMV Works​

  1. Card inserted into terminal (or tapped for contactless)
  2. Chip generates unique cryptogram for this transaction
  3. Cryptogram sent with auth request
  4. Issuer validates cryptogram
  5. Cryptogram can't be reused (prevents replay attacks)

Why Chip Is Secure​

Magnetic StripeEMV Chip
Static dataDynamic cryptogram
Easily clonedCan't be copied
No transaction bindingUnique per transaction
Counterfeit-proneCounterfeit-resistant

Liability Shift​

The Rule​

When fraud occurs, liability falls on the party that didn't support EMV:

Card TypeTerminalLiability
Chip cardChip terminalIssuer
Chip cardSwipe-only terminalMerchant
Non-chip cardAny terminalIssuer
Chip cardChip failed, swipe fallbackUsually merchant

Key Dates​

RegionLiability Shift Date
US (non-fuel)October 2015
US (fuel/AFD)April 2021
Europe2005-2006
Canada2011-2012
Latin AmericaVaries by country

What This Means​

If you have:

  • Chip-enabled terminals: Protected from counterfeit liability
  • Swipe-only terminals: Liable for chip card counterfeits
  • Fallback transactions: Need to follow proper procedures

Contactless Payments​

How Contactless Works​

  1. Card or device tapped on terminal
  2. NFC communication (short range, under 4cm)
  3. Same EMV chip technology, wireless
  4. Cryptogram generated and validated
  5. Transaction completes in seconds

Contactless Methods​

MethodTechnologySecurity
Contactless cardChip via NFCEMV cryptogram
Apple PayDevice token + biometricEMV + device binding
Google PayDevice token + authEMV + device binding
Samsung PayMST or NFCVaries by mode

Contactless Transaction Limits​

Transactions above certain amounts require additional authentication (PIN or device auth):

RegionTypical LimitNotes
USNo strict limitCVM threshold varies
UK£100Raised from £45 during COVID
EU€50 typicalVaries by country
CanadaCAD $250Raised during COVID
AustraliaAUD $200Higher than most

When PIN Is Required​

Even on contactless, PIN may be required when:

  • Amount exceeds limit
  • Cumulative contactless spend exceeds limit
  • Random PIN verification (issuer-determined)
  • High-risk merchant category

Fallback Procedures​

When chip can't be read, fallback to swipe may be allowed, but creates liability.

Proper Fallback Process​

  1. Attempt chip first - Always try chip read
  2. Second attempt - Try chip again if first fails
  3. Terminal prompts fallback - Only after chip failures
  4. Document the reason - Error log for disputes
  5. Swipe only as last resort - With proper fallback indicator

Fallback Red Flags​

Watch for fraud patterns:

  • Customer insists on swiping
  • Chip "doesn't work" but card looks fine
  • Multiple fallback attempts
  • High-value fallback transactions

Fallback Liability​

  • Proper fallback documented: Reduced liability (depends on network)
  • Forced fallback without chip attempts: Full merchant liability
  • Pattern of fallbacks: May indicate fraud or terminal issues

Terminal Configuration​

EMV Certification Requirements​

RequirementPurpose
EMV L1Physical contact interface
EMV L2Application layer protocol
EMV L3Payment brand certification
Contactless L1/L2/L3NFC interface certification

Terminal Checklist​

  • Chip reader functional
  • Contactless reader enabled
  • Proper fallback configured
  • PIN pad working
  • Certification current
  • Software up to date

Common Terminal Issues​

IssueImpactFix
Chip reader dirtyFailed reads, fallbackClean regularly
NFC disabledNo contactlessEnable in settings
Old firmwareSecurity gapsUpdate software
PIN pad malfunctionNo PIN verificationRepair/replace

Fraud Prevention Impact​

EMV Effect on Fraud​

Fraud TypeBefore EMVAfter EMV
Counterfeit (CP)HighDown 75%+
Lost/stolen (CP)ModerateUnchanged (need PIN)
Card-not-presentModerateUp (fraud migration)

Fraud Migration​

EMV reduced card-present fraud but pushed fraudsters to:

Apple Pay / Google Pay​

Additional Security​

Beyond EMV, mobile wallets add:

FeatureSecurity Benefit
Device bindingToken only works on that device
Biometric authFace ID, fingerprint required
No card numberToken replaces PAN
Transaction limitCan be unlimited with biometric

Fraud Rates​

Mobile wallet transactions typically see:

  • 50%+ lower fraud than raw cards
  • Higher approval rates
  • Fewer false declines

Merchant Considerations​

  • Accept Apple Pay / Google Pay (no additional cost)
  • Ensure NFC is enabled on terminals
  • Train staff on tap-to-pay
  • Update signage to show acceptance

Scale Callout​

VolumeFocus
Under $100k/moEnsure all terminals are EMV-enabled; accept contactless; minimize fallback
$100k-$1M/moMonitor fallback rate; track counterfeit chargebacks; terminal maintenance schedule
Over $1M/moTerminal fleet management; fallback analysis by location; contactless adoption metrics

Where This Breaks​

  • Swipe-only terminals still in use - Automatic liability for chip card fraud
  • Forced fallback by staff - Creates liability, may indicate collusion
  • Disabled contactless - Missing easy, secure payment option
  • Outdated firmware - Security vulnerabilities
  • No PIN preference - Lost/stolen cards easier to use

Test to Run​

  1. Audit all terminals - Confirm EMV and contactless enabled
  2. Track fallback rate - Should be under 2% of chip card transactions
  3. Check contactless adoption - What % of transactions?
  4. Review counterfeit chargebacks - Are you seeing 10.1/10.2 codes?
  5. Staff observation - Are proper procedures followed?

Success criteria: Zero non-EMV terminals, fallback under 2%, no terminal-related chargebacks

Next Steps​

Setting up EMV terminals?

  1. Card-Present Terminal Decisions - Hardware selection guide
  2. Terminal Operations - Deployment and management
  3. EMV Liability - Liability shift rules

Optimizing contactless acceptance?

  1. Digital Wallets - Apple Pay, Google Pay integration
  2. Authorization Decisioning - Approval optimization
  3. Auth Optimization - Maximize contactless approvals

Reducing card-present fraud?

  1. Card-Present Fraud - Fraud patterns and prevention
  2. Third-Party Fraud - Stolen card prevention
  3. Terminal Security - Physical security controls
Last updated on