Liability shift
What is liability shift?
Liability shift is the transfer of responsibility for a card transaction from the merchant to the card . It applies when the merchant authenticates the payment through a method the card schemes recognise, such as online or an EMV chip (Europay, Mastercard, Visa) read at the .
Responsibility falls on the party using the least secure technology. If a completes a transaction with 3D Secure authentication, or presents a chip card at a terminal that supports chip, the issuing bank absorbs the loss when that transaction turns out to be fraud. If the merchant's terminal or payment system doesn't support these technologies, liability stays with the merchant. The authentication result travels with the transaction, so the records the proof in the authorization message at the moment of sale, not when a dispute arrives months later.
Key facts
- Also known as: fraud liability shift, chargeback liability shift
- Triggered by: 3D Secure authentication for payments; EMV chip acceptance for card-present payments
- Who absorbs the loss: the issuing bank
- Covers: fraud reason codes only – Visa 10.1 through 10.5 (10.4 is the card-absent fraud code), Mastercard 4837
- Does not cover: , goods not received, service disputes, processing errors
- Evidenced by: the Electronic Commerce Indicator (ECI) returned with the authentication result. The ECI records whether authentication succeeded, was attempted, or never happened, and it's the value the scheme checks when deciding who owns a fraud .
How it works
- The merchant requests authentication. For a card-not-present payment, the transaction is sent to 3D Secure before authorization rather than straight to the issuer.
- The issuer evaluates the cardholder. It either approves the session on the device and behavioural signals alone, or asks the cardholder to confirm identity directly through a .
- An authentication result is returned. The issuer sends back an ECI value and an authentication token that together prove what happened during the check.
- The result is carried into authorization. The payment processor includes those values in the authorization message, which is where the scheme later looks to see whether the shift applies.
- A dispute is tested against the record. When a fraud is filed on an authenticated transaction, the scheme blocks it or reverses it back to the issuer, and the merchant keeps the funds.
Why it matters
- A fraud chargeback on an authenticated transaction is absorbed by the issuing bank, so the merchant keeps both the revenue and the chargeback fee it would otherwise pay.
- Disputes that the scheme blocks are never filed against the merchant, so they don't enter the chargeback count that schemes use for monitoring programmes.
- Authentication adds a step before authorization. Cardholders who abandon at the confirmation screen never reach the issuer, so the loss shows up as missing volume rather than as declines in the authorization report.
Common issues
- Non-fraud disputes stay with the merchant. A cardholder claiming an item never arrived, a subscription wasn't cancelled or a refund wasn't issued files under a non-fraud reason code, which the shift doesn't touch.
- Friendly fraud isn't covered in practice. A cardholder who authenticated the payment and later disputes it is arguing about the purchase, not about card misuse, and issuers route those claims through codes the shift doesn't reach.
- Recurring and merchant-initiated payments break the chain. Authenticating the first payment of a subscription doesn't automatically extend protection to later charges, and the rules for subsequent transactions differ by scheme.
- Failed or skipped authentication looks the same as none. A transaction sent through 3D Secure but returned without a successful authentication indicator carries no protection, even though the merchant paid the conversion cost of the extra step.
- Geographic scope varies. is mandated in the EEA and the UK, while elsewhere 3D Secure is a commercial decision. The EMV chip shift applies to card-present payments and was rolled out market by market.
