---
title: "EMV"
url: "https://mahouse.world/glossary/emv"
type: "glossary term"
topic: "Payment security"
author: "Ihor Vlasov"
reviewed: "2026-09-20"
published: "2026-08-10"
---

# EMV

EMV is the global standard for chip cards and the terminals that read them — named for Europay, Mastercard and Visa and maintained by EMVCo — under which a card's chip generates a unique cryptogram for every transaction, so copied data cannot be replayed as a magnetic stripe could. Its liability-shift rules drove Europe's migration in the 2000s and the US's from 2015; contactless, tokenisation and 3DS 2 are its specifications too.

**Also known as:** EMV chip, Chip and PIN, EMV standard, EMVCo

## Key facts

- **Used at:** every chip and contactless card transaction worldwide; over 90% of card-present transactions globally are EMV
- **Binding:** the EMV specifications (contact, contactless, tokenisation, 3DS, QR, secure remote commerce) and the schemes' migration mandates and liability shifts; terminals and cards are certified against them
- **Typical mechanics:** the chip and terminal exchange data; the chip signs the transaction with a key only the issuer can verify, producing a cryptogram; cardholder verification is by PIN (Europe), signature (US, historically) or the phone's biometric (wallets); the issuer checks the cryptogram at authorisation
- **Typical effect:** counterfeit card fraud fell by 70–90% in markets after migration; fraud moved online, which is why card-not-present fraud rose and 3-D Secure mattered more
- **Parties:** EMVCo (owned by the six major schemes), issuers, acquirers, terminal and card manufacturers, the certification labs, and merchants who bought new terminals

## How EMV works in practice

A card is inserted or tapped. The terminal and the chip negotiate: which applications the card supports, what verification method to use, whether to go online. The chip computes a cryptogram over the transaction data using a key it shares with the issuer; the terminal sends the cryptogram with the authorisation; the issuer verifies it — this transaction, this card, this amount, once — and approves. A skimmer that copied the chip's data could not produce the next cryptogram, so cloning the card is not feasible; the magnetic stripe, which held static data, could be copied at a petrol pump and written onto a blank in minutes.

The migration was driven by liability. The schemes announced that after a date, fraud on a counterfeit card would be borne by whichever party — issuer or merchant — had not adopted EMV: a merchant with a stripe-only terminal accepting a chip card paid for the fraud; an issuer with a stripe-only card accepted at a chip terminal paid likewise. Europe migrated in the 2000s under chip-and-PIN; the US, with its larger installed base and signature habit, set its shift for October 2015 and took years more to complete. Counterfeit fraud fell everywhere it happened; fraud moved to e-commerce, where the chip is absent.

EMVCo's remit grew: contactless, the tokenisation framework behind network tokens, 3-D Secure 2, QR codes, and Secure Remote Commerce (click to pay) are all its specifications — which is why "EMV" appears on every layer of a payments company's technology diligence.

## Example

A US retail chain with 1,200 stores delays its EMV terminal upgrade past the October 2015 liability shift because the rollout costs $9m. In the following year counterfeit-card chargebacks it previously could not be charged for — $2.4m — are charged back to it under the shift, as fraudsters target stripe-only merchants. It upgrades in 2016 at $9.5m with contactless included; counterfeit chargebacks fall to $120,000; contactless adoption in 2020 pays for the NFC it bought by accident. Its European subsidiary, chip-and-PIN since 2006, had never understood the delay.

## Common mistakes

- Treating EMV as a card technology rather than as a family of specifications across the whole stack.
- Delaying a liability-shift deadline and paying for the fraud the shift allocates.
- Assuming chip cards ended card fraud; they moved it online.
- Terminals certified for contact EMV and not contactless, replaced early.
- Confusing EMV (the chip standard) with PCI DSS (the data-security standard); both apply, differently.

## Related terms

- [Contactless Payment](https://mahouse.world/glossary/contactless-payment.md)
- [Card-Present Transaction](https://mahouse.world/glossary/card-present-transaction.md)
- [Point of Sale](https://mahouse.world/glossary/point-of-sale.md)
- [Near Field Communication](https://mahouse.world/glossary/near-field-communication.md)
- [3-D Secure 2](https://mahouse.world/glossary/3-d-secure-2.md)
- [Tokenization](https://mahouse.world/glossary/tokenization.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-20. https://mahouse.world/authors/ihor-vlasov