How a liability shift works
Fraud on an online card payment normally falls on the merchant: the issuer charges the payment back and the acquirer passes the loss on. A liability shift changes that outcome when a stronger technology was used, or when one side supports it and the other does not.
- 3-D Secure: a fraud chargeback can be refused when the payment was authenticated and the authorisation carried the proof
- EMV chip: counterfeit fraud on a chip card that was accepted without reading the chip can be charged back to the acquirer
Liability shift in Mastercard's Chargeback Guide
Mastercard's Chargeback Guide of 13 May 2025 names two chargeback reasons after the rule: chip liability shift for counterfeit fraud, and for lost, stolen or never-received cards. The same guide lets an acquirer answer a no-cardholder-authorisation chargeback by showing that the transaction was authenticated and approved by the issuer. The 3-D Secure entry sets out the Visa and Mastercard rules for authenticated payments.
What a liability shift does not cover
The shift concerns fraud: the claim that the cardholder did not make the payment. Disputes about goods not delivered, cancelled subscriptions and processing errors are untouched. The shift is also conditional, since the authentication data has to be passed correctly in the authorisation message.
For a merchant, liability shift is the commercial reason to use 3-D Secure where the law does not already demand it. For a gateway, it means sending the right indicators with every authorisation and keeping them for dispute responses.
Liability shift or strong customer authentication?
- Strong customer authentication
- A legal duty in the EU and the UK to authenticate electronic payments. Liability shift is a scheme rule about who bears a fraud loss, and 3-D Secure serves both.
- Chargeback protection
- A commercial guarantee from a fraud vendor or payment provider that it will absorb fraud chargebacks. A contract, not a scheme rule.
Where the liability shift shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
Platforms that need it
Guides that go deeper
Where it is written
The laws and standards this page's facts come from.
General information, not legal advice: what applies to you depends on your services and your market.