Card-Present Fraud: Liability, Evidence, and Chargeback Response

Card-present fraud is the unauthorized or deceptive use of a payment credential in a face-to-face payment environment. It can involve a stolen genuine card, a counterfeit credential, misuse of a wallet, or manipulation of the payment process.

A person standing at the counter is not proof of cardholder authorization. Build store controls around recorded payment behavior, terminal integrity, and consistent escalation procedures rather than a customer’s appearance.

Recognize the Operational Risk Without Presuming Guilt

Keep counterfeit card fraud separate from use of a stolen genuine card. The relevant evidence and EMV liability rules can differ.

Make Terminal Integrity a Repeatable Store Process

PCI SSC identifies device inventory, periodic inspections, and staff training as key controls for deployed payment devices. Its device-security guidance does not make a physical tether the only acceptable control.

• Maintain each device’s identifier, location, and approved appearance.
• Assign inspections according to the organization’s risk assessment and applicable security requirements.
• Check unexpected attachments, changed seals, loose components, and device substitutions.
• Verify maintenance personnel through the established service process.
• Define who can remove a suspicious terminal from use and contact the payment provider.

Keep inspection logs separate from customer allegations. A tampered reader may expose multiple customers; an isolated disputed sale does not by itself prove the reader was compromised.

Use Supported Payment Flows and Escalation Rules

Use properly configured chip and contactless acceptance. EMVCo explains that chip technology supports transaction security and multiple verification methods in its contact-chip overview. It does not make stolen-card use or every other fraud scenario impossible.

Do not coach staff to bypass a decline or force manual entry to finish a sale. Establish acquirer-approved procedures for unreadable cards and terminal faults. Offer another supported payment method when appropriate. Do not impose ad hoc identity-document collection as a universal card-acceptance requirement.

Treat wallet payments according to the actual transaction flow. The Apple Pay chargeback guide and Google Pay chargeback guides explain why a wallet label alone does not establish liability protection.

Respond to Suspected Compromise Safely

• Stop using a device suspected of tampering and follow the incident-response plan.
• Notify the designated security owner and payment provider.
• Preserve relevant logs, device identifiers, and the observation timeline.
• Avoid altering or dismantling the device unless the incident team instructs you.
• Record which transactions need review and who owns follow-up.

Keep staff safety first. An employee should not confront a customer or attempt to seize a card as a substitute for a documented escalation process. Broader payment fraud prevention should align store operations, security, and dispute teams.

Connect the Incident to Any Later Dispute

When a chargeback arrives, collect the specific payment record, receipt, entry method, relevant verification result, and any refund. Ask the acquirer what additional records are needed. Evidence of a chip-capable device is not evidence of how every transaction was processed.

Use consistent evidence categories and the actual claim when preparing a chargeback response. You can organize supported dispute workflows with Chargeflow’s automated recovery.

Foire aux questions

Can card-present fraud happen with chip cards?

Card-present fraud can still involve stolen genuine cards, manipulated payment flows, or other misuse. Chip technology reduces counterfeit risk but does not eliminate every type of fraud.

Does a chip decline justify manual entry?

A chip decline should be handled according to the terminal and acquirer instructions. Staff should not bypass a decline through manual entry simply to complete a sale.

What should staff do if a terminal looks altered?

Staff should stop using a terminal suspected of tampering, follow the incident plan, notify the designated owner, and preserve relevant records without dismantling the device.