Liability Shift

A liability shift is a rule under which the financial loss from a fraudulent payment moves from the party that would normally bear it to another party. In card payments the rules are written by the card networks and follow a simple principle: the loss falls on the side that did not support the more secure technology. If a merchant uses the stronger method and fraud still occurs, the card issuer absorbs it; if the merchant does not, the merchant does.

The two best-known examples are the chip liability shift for in-store payments and the authentication liability shift for online payments made with 3-D Secure. Both were designed as incentives, giving merchants and issuers a financial reason to invest in security without an outright mandate. The mechanism through which liability is assigned in practice is the chargeback.

The starting allocation depends on how the card was used. In a card-present transaction that the issuer has authorized, the issuer has traditionally borne fraud losses, because the merchant had the card in hand and followed the acceptance procedure. In a card-not-present transaction, such as an online order, the merchant bears the loss, because it accepted card details without being able to check the card or the person. A cardholder who reports an unauthorized payment is refunded by the issuer, which then recovers the money from the merchant's acquirer where the rules allow. These rules are part of each scheme's card network rules.

Chip cards were introduced to defeat counterfeiting. Data on a magnetic stripe is static and easily copied, whereas an EMV chip produces a unique cryptogram for each transaction. To push adoption, the networks changed the card-present rule: when a counterfeit copy of a chip card is used at a terminal that cannot read chips, the loss moves from the issuer to the merchant's side. Where both parties support chip, or neither does, the earlier allocation stands.

The shift took effect region by region, beginning in Europe in the mid-2000s. In the United States the main networks applied it to store terminals from October 2015, with a later date for automated fuel pumps because of the cost of replacing them. Some networks also apply a lost-and-stolen shift, which places liability on the party that did not support chip and PIN.

The effect was rapid migration to chip terminals, a sharp fall in counterfeit fraud at the point of sale and a movement of fraud toward online channels.

For online payments the equivalent incentive is tied to cardholder authentication. When a merchant sends a transaction through EMV 3-D Secure and the issuer authenticates the cardholder, responsibility for a later fraud claim moves from the merchant to the card issuer. This applies whether the issuer challenged the cardholder for a code or biometric, or approved silently through the frictionless flow on the basis of risk data. In many cases it also applies when the merchant attempted authentication but the issuer or card did not take part.

The protection covers fraud disputes only. A cardholder can still dispute an authenticated transaction because goods did not arrive or a subscription was not cancelled, and the merchant remains responsible for those claims. Networks also exclude some transaction types and may withdraw the protection from merchants with excessive fraud levels.

European rules on strong customer authentication created a trade-off between convenience and liability. A merchant or acquirer may ask for a strong customer authentication exemption, for example for a low-value or low-risk payment, so that the customer is not challenged. If the exemption is requested by the merchant's side and the payment proves fraudulent, liability generally stays with the merchant's side. If the issuer chooses to apply an exemption itself, the issuer keeps the liability.

Payments made with a device-based digital wallet are usually treated as authenticated, because the cardholder unlocked the device with a fingerprint, face or passcode and the transaction carries a token cryptogram. Issuers therefore tend to bear fraud losses on these payments, online as well as in store. Merchant-initiated charges, such as subscription renewals, are not authenticated at the time they are made and rely on the authentication of the first payment.

A liability shift changes who pays, not whether fraud happens, and it does not guarantee the merchant an approval. Issuers that carry the risk on authenticated payments may decline more of them, and merchants must weigh the protection against customers lost at the authentication step. Fraud claims may still be raised under the wrong chargeback reason code, and friendly fraud, in which a genuine cardholder denies a purchase, is often filed as a service dispute to which the shift does not apply. The merchant also keeps the chargeback liability in every category the shift does not cover.

The same idea is used outside cards. Rules for account-to-account payments increasingly assign losses to payment providers instead of customers: in the United Kingdom, since October 2024, the sending and receiving firms share the cost of reimbursing most victims of authorized push payment fraud.