Since October 2015, counterfeit card fraud at the point of sale is charged to whichever party is less EMV-capable — and if you're swiping chip cards on an old magstripe terminal, that party is you. A single counterfeit transaction means losing the sale amount, the goods, and a chargeback fee, with no realistic way to dispute it. And liability is only the loudest cost: old terminals also bleed money through interchange downgrades, lost contactless sales, and PCI/TLS compliance headaches. If your terminal can't dip a chip and take a tap, replacing it — often at no cost through an upgrade program — pays for itself quickly.
What did the 2015 liability shift actually change?
Before October 2015, in-person counterfeit card fraud was mostly the issuing bank's problem. A fraudster cloned a card, bought $500 of merchandise, the real cardholder disputed it — and the bank ate the loss. Merchants were largely insulated as long as they followed basic acceptance procedures.
The card networks wanted the U.S. to adopt chip cards, and rather than mandate them, they changed who pays. The EMV liability shift is a simple rule: when counterfeit fraud happens in person, the loss falls on whichever party — issuer or merchant — is less EMV-capable. No fines, no mandates. Just a quiet reassignment of risk that made old hardware expensive.
Plain-English scenarios, because the matrix confuses everyone:
- Chip card, dipped in your chip terminal, still fraudulent: the bank's problem. You did your part; the issuer eats it. This is the pre-2015 status quo, preserved for EMV-capable merchants.
- Chip card, swiped on your magstripe-only terminal: your problem. You were the less-capable party. The issuer charges the transaction back and you lose — automatically.
- Old magstripe-only card (increasingly rare), swiped anywhere: the bank's problem — the issuer was the less-capable party for not issuing a chip card. Since virtually every U.S. card now has a chip, this scenario has nearly vanished.
- Chip terminal present, but staff swipes anyway or uses fallback: gray zone that usually resolves against the merchant. Fallback swipes (chip fails, terminal allows swipe) carry elevated risk and get scrutinized.
Two boundaries worth knowing. First, the shift covers counterfeit (and for some networks, lost/stolen) card-present fraud — it does not cover online fraud, which was always the merchant's liability, or ordinary "I didn't like the product" disputes, which run through the normal process we cover in our chargebacks guide. Second, gas pumps got an extended deadline (2021), which is why pay-at-pump was the last holdout you remember swiping at.
What does a counterfeit card cost you in dollars?
When a liability-shift chargeback lands, the arithmetic is brutal because you lose on every line at once:
- The full transaction amount — clawed back from your account.
- The goods or services — already out the door. A $600 counterfeit sale on 50% margin product means $300 of hard cost gone plus $300 of margin never earned.
- A chargeback fee — typically $15–$100 depending on your processor.
- Your time — except there's nothing to spend it on, because these chargebacks (Visa reason code 10.1 and its cousins) are effectively indefensible. The network's position is simple: you had ten years to get a chip reader.
Now add the behavioral kicker: fraud concentrates where it works. Counterfeit magstripe fraud didn't disappear after 2015 — it migrated to the shrinking pool of swipe-only merchants. People running cloned cards actively seek out businesses still swiping, because that's where the scheme still cashes out. Running a magstripe-only terminal in 2026 isn't neutral; it's advertising.
One more scenario Texas retailers should hear: a Dallas store selling resellable goods — electronics, tools, liquor, gift cards — is a magnet for exactly this play. Three counterfeit transactions in a bad month at $400 each is $1,200 plus fees, quietly exceeding the cost of a modern terminal several times over. Merchants tend to discover the liability shift the expensive way, one chargeback at a time.
Watch fallback swipes even on chip-capable terminals. If the chip "fails to read" and your staff swipes instead, you may inherit liability — and a customer who insists the chip "never works" on a card that looks worn is running a known play: damaged chips force fallback to the clonable magstripe. Train staff to try the chip twice, then ask for another card, not to reach for the swipe.
How else do old terminals cost you money?
Liability gets the headlines, but for most merchants the quieter costs of old hardware are bigger, because they land on every transaction instead of the rare fraudulent one.
Interchange downgrades
Card networks price transactions by risk and data quality, and old terminals systematically qualify transactions worse. Keyed-in entries (the default coping mechanism when an old reader gets flaky) can cost 0.5–1.0% more than a dipped or tapped transaction, and missing data triggers downgrade categories that hide inside interchange where you'll never see them itemized. If your staff keys cards "because the reader is temperamental," you're paying card-not-present prices for card-present sales — on every one. We break down how downgrades bury themselves in your statement in our processing cost guide.
No contactless — lost sales and slower lines
Tap-to-pay went from novelty to default in about five years; contactless is now the majority of card-present transactions at merchants who accept it, and a large share of those taps are phones and watches. A terminal that can't take Apple Pay or Google Pay creates real friction: the customer who doesn't carry a physical card (increasingly common under 30), the line that moves slower because every payment is a dip-and-wait, the walk-away you never see. Tap transactions also complete in a second or two, which at a busy counter is throughput — more customers served per hour with the same staff.
Auth-rate and security drag
Newer terminals send richer data with each authorization, and cleaner data means fewer false declines — a decline on a good customer is a lost sale plus a bruised relationship. Meanwhile, aging devices fall off the support treadmill: old TLS versions get retired by processors (the TLS 1.0/1.1 sunsets already stranded a generation of terminals), security patches stop, and PCI compliance questionnaires get harder to answer honestly with unsupported hardware in the stack. An out-of-support terminal is a compliance finding waiting to be written.
The repair treadmill
Out-of-warranty repairs, overnight replacement fees, downtime during a Saturday rush — the total cost of nursing a dying terminal along routinely exceeds the cost of a new one that would also fix everything above.
When should you replace — and when are you fine?
Not every old-ish terminal needs to go. Honest triage:
| Your terminal… | Verdict | Why |
|---|---|---|
| Swipe-only, no chip slot | Replace now | You carry full counterfeit liability and attract the fraud that goes with it |
| Chip-capable but no contactless/tap | Replace soon | Liability is covered, but you're losing tap sales, speed, and wallet users daily |
| Chip + tap, but past manufacturer end-of-life / no security updates | Replace this year | PCI exposure and processor TLS sunsets will force the issue on their schedule, not yours |
| Chip + tap, supported, updated firmware | Keep it | You're fine — spend the money elsewhere and revisit at end-of-support |
Also replace on workflow grounds regardless of age if your terminal can't do things your pricing program needs — dual pricing display, on-screen tipping, itemized receipts — because working around missing features has its own daily cost.
Find your terminal's model number (usually on the underside label) and search it with "end of life." Manufacturers publish sunset dates, and processors publish TLS/gateway retirement schedules. Ten minutes of checking tells you whether the clock is already running on your hardware — before a mid-December "your device will stop processing on the 31st" letter tells you instead.
What does a modern terminal actually unlock?
The replacement case isn't only about avoiding losses — current hardware is a genuine capability upgrade:
- Every acceptance method: dip, tap, swipe (as fallback), Apple Pay, Google Pay, Samsung Pay — one device, no lost sale because of how the customer wanted to pay.
- Dual pricing display: modern screens present the cash price and card price cleanly at checkout and itemize them on the receipt — the configuration that keeps a Texas dual pricing program compliant with card-brand display rules instead of taped-on signage doing legal work it can't do.
- On-screen tipping: customer-facing tip prompts consistently raise tip rates versus the pen-and-line method, and they eliminate end-of-day tip-adjust errors that trigger disputes.
- Better qualification: correct EMV data on every transaction means fewer downgrades and cleaner interchange — a per-transaction savings that compounds silently.
- Modern security baked in: current devices ship with point-to-point encryption and tokenization support, which shrinks your PCI scope dramatically — the full story is in our companion piece on tokenization and P2PE.
- Remote updates and support: firmware, price changes, and diagnostics handled over the network instead of a technician visit or a swap in the mail.
Even chip-and-tap hardware sometimes ships with contactless disabled in the configuration — merchants go years not knowing. Test your own counter this week: tap your phone on your terminal. If it doesn't take the payment, call your processor and ask them to enable NFC before you spend a dime on new equipment; it may be a settings fix, not a hardware problem.
What does an upgrade cost (spoiler: maybe nothing)?
Modern countertop terminals run a few hundred dollars; full smart-terminal setups more. But here's the practical note for our neighbors: Lone Star Payments runs a POS upgrade program that covers up to $5,000 in new equipment for qualifying merchants who move their processing to us — which for most counter businesses means the liability shift, the contactless gap, and the end-of-life clock all get solved in one conversation, at no hardware cost. We'd rather put current, secure smart terminals on your counter than compete with a fraudster for your margin. Even if you don't work with us, ask whatever processor you use what upgrade support they offer before paying retail for hardware — it's a standard lever in this industry, and one worth negotiating.
How do you retire the old unit safely?
The last step everyone skips: the old terminal doesn't go in a drawer or a dumpster. Payment terminals contain injected encryption keys, and depending on age and configuration, merchant and configuration data. Proper decommissioning:
- Tell your processor. The device should be deactivated and de-registered so it can't authorize anything, and so a "lost" terminal can't be repurposed in a skimming scheme.
- Wipe or destroy. Follow the processor's guidance — some devices support a key-erase; for others, physical destruction of the secure module is the answer. PCI DSS expects media and devices that touched cardholder data to be decommissioned securely, and your annual questionnaire asks about it.
- Recycle responsibly. E-waste programs take terminals; several DFW municipal collection events do too. If we install your new hardware, we haul off and handle the old units as part of the job.
Keep a one-line record — device model, serial, date retired, how — so next year's PCI questionnaire is a checkbox instead of an archaeology project.
- Since 2015, counterfeit card-present fraud falls on the least-EMV-capable party — swipe a chip card on old hardware and that's you, with no dispute path.
- One counterfeit sale costs the transaction, the goods, and a fee — and fraudsters deliberately hunt swipe-only merchants.
- The quieter costs are bigger: interchange downgrades, lost contactless sales, slower lines, and PCI/TLS end-of-life exposure.
- Keep a supported chip + tap terminal; replace anything swipe-only, tap-less, or past end-of-life.
- Modern terminals unlock wallets, dual pricing display, on-screen tips, and P2PE — and Lone Star's upgrade program covers up to $5,000 in equipment for qualifying merchants.
- Decommission old units properly: deactivate, wipe or destroy, recycle, and note it for PCI.
Frequently asked questions
What is the EMV liability shift in plain English?
It's the 2015 rule change that says: when a counterfeit card is used in person, whoever was less chip-capable pays. If the bank issued a chip card and you only had a swipe reader, the fraud loss is charged back to you automatically. If you had a chip reader and did everything right, the issuing bank keeps the loss like it did before 2015.
Is it illegal to keep using a swipe-only terminal?
No. There's no law or card-brand fine for magstripe-only acceptance. The penalty is structural: every counterfeit chip card swiped through it becomes your loss instead of the bank's, and counterfeit fraud actively migrates toward the merchants where it still works. You're legal — you're just self-insuring against professional fraud.
How much does one counterfeit transaction actually cost me?
The full sale amount is charged back, the merchandise is already gone, and your processor adds a chargeback fee of roughly $15–$100. Liability-shift chargebacks are effectively indefensible, so there's no recovery path. On a $600 sale of 50%-margin goods, you're out roughly $300 in hard cost, $300 in margin, and the fee — from one transaction.
My terminal takes chips but not tap — do I really need to upgrade?
You're covered on counterfeit liability, so there's no emergency. But contactless is now the majority of card-present payments where it's accepted, taps are faster than dips at a busy counter, and phone/watch payers can't pay you at all. Add manufacturer end-of-life and TLS sunset risk, and "replace soon" is the honest answer — especially if an upgrade program makes it free.
What do I do with the old terminal after upgrading?
Have your processor deactivate and de-register it, wipe or physically destroy the secure module per their guidance, and recycle it through an e-waste program. Terminals hold encryption keys, and PCI DSS expects secure decommissioning — keep a one-line record of model, serial, and disposal date for your annual questionnaire.
Still swiping? Let's fix that this week.
Qualifying merchants get up to $5,000 in modern terminal equipment through our upgrade program — chip, tap, wallets, dual pricing display, and P2PE security included. We'll even decommission the old hardware properly.