The EMV liability shift: who eats the cost when a card is keyed in instead of tapped or dipped
By Yan Payments
Who’s liable when a keyed-in card turns out to be fraud?
How a card gets accepted, chip, tap, or manually keyed, determines who eats the loss if that transaction turns out to be fraud. Chip and tap transactions generally push liability to whichever side (you or the card’s issuing bank) has the weaker technology in that specific transaction. Keyed-in transactions, like taking a phone order on a Clover Flex when the customer isn’t standing in front of you, work differently: the liability usually sits with you by default, no matter how good your fraud tools are. If you take phone or mail orders regularly, that distinction is worth understanding before a dispute shows up, not after.
How does the EMV liability shift actually work?
Since the US EMV liability shift took effect for most transaction types, the rule for card-present fraud has been: liability goes to whichever party has the lower level of chip technology in that transaction. If a customer hands you a chip card and your terminal only supports swipe-and-sign, and that transaction turns out to be fraudulent, you’re on the hook, because you’re the one who didn’t support the better technology. Flip it around: if your terminal reads the chip but the card itself is still a swipe-only card, rare at this point but it happens with some foreign-issued cards, the liability shifts to the card issuer instead, since they’re the ones behind on the technology.
Tap-to-pay (NFC) transactions, including Apple Pay and Google Pay, generally get treated the same as chip transactions for liability purposes, since they rely on the same chip-based security standard underneath the contactless interface.
Why are keyed-in transactions riskier for the merchant?
Manually keying in a card number, whether that’s a phone order, a mail order, or just typing in a number because a chip reader failed, is treated differently. If you key in a card on your regular retail merchant account, you’re typically liable for a resulting chargeback regardless of how the fraud happened, because the card was never actually read by any chip or tap technology at all. There’s no shift to argue about; a keyed transaction on a standard retail account is close to the highest-risk category a card network recognizes.
This is exactly the situation a lot of restaurants and retailers run into without realizing it: taking a to-go order over the phone and keying the card into a Clover Flex or Mini at pickup. It’s a completely normal way to do business, but it carries different fraud exposure than a card tapped or dipped in person.
What’s the fix for businesses that regularly take phone orders?
If keyed-in orders are a regular part of how you take payments, not an occasional exception, ask Yan Payments about setting up a MOTO (mail order/telephone order) merchant account alongside your regular retail account. MOTO accounts are built specifically for card-not-present, keyed transactions. They typically come with tools like Address Verification Service (AVS) and CVV checks baked into the authorization flow, and they’re priced and underwritten with that risk already factored in, rather than treating every keyed transaction as an exception on an account designed for swipes and taps.
Running keyed orders through the right account type doesn’t make fraud disappear. It does mean your pricing and your risk tools actually match what you’re doing, instead of quietly carrying card-not-present risk on an account that assumes the card is in front of you.
Does chip adoption affect card-not-present fraud liability?
Worth saying plainly: EMV chip adoption never changed who’s liable for card-not-present fraud. That liability sat with merchants before the chip liability shift and still does. What’s changed over time is the tooling available to reduce the odds a bad transaction goes through in the first place, AVS matching, CVV verification, and for higher-volume online sellers, 3D Secure-style authentication. None of that shifts liability the way a chip-to-chip transaction does; it just lowers the chance you end up disputing a chargeback at all.
A quick way to check your exposure
| How the card was accepted | Who’s generally liable for fraud |
|---|---|
| Tapped or dipped, both sides chip-capable | Issuer |
| Swiped on a chip-capable terminal, chip not used | You |
| Keyed in by phone or mail, standard retail account | You |
| Keyed in on a properly set up MOTO account with AVS/CVV | Still you, but with better tools to catch it first |
If you’re regularly taking orders by phone, it’s worth a quick call to confirm you’re on the right account type for how you’re actually taking payments. For more on fighting a chargeback once one lands, see our earlier post on documenting friendly fraud disputes.
This is general information about how card network liability rules typically work, not legal advice. Specific liability outcomes depend on your processor agreement and the card network rules that apply to your account.
Sources
← Back to all posts