1. What are EMV Parameters?

When a card is inserted, the Terminal and Card exchange TLV data. Key parameters configured in terminal / issuer host:

2. Types of Misconfiguration Attacks Seen in Real World

a) Forced Fallback Attack: Terminal configured to allow easy fallback to magstripe. Fraudster intentionally damages chip, terminal falls back to swipe, cloned magstripe data is used. This is expressly prohibited by RBI circular dated Aug 11, 2016 - all existing machines to be EMV capable by Sept 30, 2017

b) TAC = 00 00 00 00 00: Terminal never declines offline. Attackers use stolen card with offline PIN bypass.

c) Replay Attack: Canadian bank case cited in research - bank incorrectly implemented EMV handling and wasn't checking cryptogram or ATC counter values. Cybercriminals spoofed EMV transaction requests to replay old transactions

d) No-CVM on High Value: Terminal configured to say "No CVM Required" up to Rs.5000. Visa reason code 10.2 triggers - stolen PIN-preferring chip card used on non-PIN compliant terminal

3. Legal Framework & Liability Shift

Global Rule - EMV Liability Shift (Oct 1, 2015 US, Oct 2010 international):
If a chip card is swiped on non-EMV terminal, party with less EMV-compliant technology is liable. If your terminal is misconfigured, outdated, or defaults to magstripe fallback—even once—you could be held liable

India - RBI Framework:

1. Zero Liability Policy: RBI Customer Protection circular dated 6 July 2017 on limiting customer liability sorts unauthorized transactions into 3 categories. If third-party breach where deficiency lies neither with bank nor customer, but elsewhere in system, customer has zero liability if notified within 3 working days.
2. Issuer & Acquirer Mandate: All new cards to be EMV chip and PIN based, acquirer banks liable for loss to customers in case of failure to ensure EMV compliance.

4. Case Laws with Direct Relevance

INDIA

1. State of Maharashtra v. Vikram Tanaji Shinde (2014)
Accused used cloned debit cards to withdraw large sums. Court recognized magnetic stripe cloning as modus operandi which EMV was meant to prevent. Basis for RBI mandating EMV.

2. Kerala High Court - SBI Ordered to Refund Rs. 3.73L to Cybercrime Victim (2024)
Facts: Customer scammed, non-chip based debit card used, reported within 24 hours.
Judgment: Justice Harisankar V. Menon observed bank did not prove customer was privy to fraudulent transaction and entitled to 'zero liability'.
Principle: Burden to prove gross negligence is on Bank.

3. Allahabad High Court - Burden of Proof on Bank
Held under RBI Circular 06.07.2017, burden to prove customer's liability in unauthorized electronic banking lies upon the bank. If bank cannot prove EMV parameters were correctly validated (ARQC, ATC check), bank pays.

4. Delhi High Court - Tony Enterprises v. RBI (2019) & SBI v. Pallabh Bhowmick SLP 30677/2024
In Tony Enterprises, police investigation established SIM swapping, loss fell on bank under zero-liability category. Court relied on Master Direction on Digital Payment Security Controls - failure to check anomalous parameters = bank breach.

5. Bombay High Court - Jaiprakash Kulkarni v. Banking Ombudsman (WP 1150/2023) MANU/MH/3477/2024 & Pharma Search Ayurveda v. Banking Ombudsman
Customer challenged Ombudsman rejection for unauthorized transaction. Court held if transaction shows fallback from EMV to magstripe without valid chip failure code, it's system breach, not customer negligence.

INTERNATIONAL / FOUNDATIONAL FOR EMV DISPUTES

6. Job v. Halifax PLC (UK, Case 7BQ00307) - Cited in Cambridge University Research on EMV Evidence Failure
Research shows EMV protocol does not produce adequate evidence for resolving disputes. In Job v Halifax, judge accepted bank's assertion that chip and PIN must mean customer present, but later research proved terminal could be misconfigured to skip PIN verification. This case changed UK law to require banks to provide full EMV logs - TVR, TSI, ATC.

7. US Merchants Class Action - B&R Supermarket v. Visa/ Mastercard (N.D. California 2016)
Merchants filed antitrust lawsuit claiming financial firms collaborated on shifting liability for illegal credit card transactions to retailers. Merchants were given until Oct 15, 2015 to switch to EMV terminals, only to be told network not certified. Resulted in chargebacks of thousands even though merchants had EMV hardware - because acquirer certification and parameter configuration was pending.

8. US Supreme Court Observation - Digital Arrest & Cyber Fraud (2025)
SC asked RBI to make banks compensate victims of digital arrest, cyber fraud, stating framework must hold financial institutions accountable where inadequate safeguards or failure to exercise due diligence contributed. Directly applicable to EMV misconfiguration as failure of due diligence.

5. How to Audit EMV Misconfiguration to Avoid Liability

1. Terminal Forensics: Pull TVR (Terminal Verification Results), TSI, ATC, CID. If TVR shows "Offline PIN not performed" for PIN-preferring card, parameter wrong.
2. Never allow fallback unless 3 consecutive chip read failures with code 86.
3. Set TAC-Denial = DC 40 FC 28 00 00 (industry best practice), not zeros.
4. Floor limit = 0 for high-risk MCCs, force online.
5. RBI Compliance Checklist: Maintain certification letter from PCI-P2PE lab, quarterly parameter review logs.

If you are an acquirer, merchant, or issuer and have received a chargeback under Visa Reason 10.2 (EMV Liability Shift Non-Counterfeit Fraud) or Mastercard Reason 4840, you have 21 days to represent with proof of correct EMV configuration - TVR, cryptogram validation, and PIN capability proof.