Payment Fraud Liability: Who Actually Eats the Loss When a Transaction Goes Bad

Fraud losses are not an act of nature. They land exactly where the rules put them, and the rules differ by rail in ways most executives have never had laid out side by side. The same fraudulent transaction produces a completely different loser depending on how the money moved. On a card, a network rulebook assigns the loss between issuer and merchant according to who authenticated the cardholder and who supported the more secure technology. On ACH, a return window governs it, and that window is dramatically shorter for a business than for a consumer. On a real-time rail, the payment is final on arrival, so if the victim authorized it the loss stays with the victim unless a regulator has intervened. On a wire, the loss almost always stays where it landed, which is why business email compromise targets wires specifically. Understanding this is not compliance trivia. It determines which rail an organization should prefer for which payment, when forcing extra authentication is economically rational, and what a processor agreement is actually promising. This guide maps liability rail by rail and translates it into operational decisions.

Key Takeaways

• Liability follows the rulebook, not the harm. The identical fraud pattern lands on the merchant, the issuer, the receiving bank, or the victim depending purely on which rail carried it and which party met the technical conditions the rules specify.
• The card networks use liability as an incentive mechanism rather than a fairness judgment. The EMV shift and 3-D Secure both work by moving the loss to whichever party declined to adopt the more secure option, which is why liability shift is best understood as a lever for driving technology adoption.
• The critical distinction on every rail is authorized versus unauthorized. Unauthorized transactions, where the customer did not initiate the payment, generally carry strong consumer protection. Authorized push payment fraud, where the victim was deceived into sending the money themselves, historically carried almost none, and this gap is the most active area of regulatory change in payments.
• Business protections are far weaker than consumer protections on every rail, and the difference is measured in days. A consumer disputing an unauthorized ACH debit has sixty days. A business has two.
• The operational takeaway is liability-aware routing: choose the rail with knowledge of who absorbs the loss for the fraud pattern that payment attracts, and treat step-up authentication as an economic decision, since it transfers liability at the cost of conversion.

Cards: Liability as an Incentive Mechanism

Card networks operate private rulebooks that allocate fraud losses between the issuing bank and the merchant's acquirer, who passes them to the merchant. The cardholder, in practice, is made whole in nearly all consumer fraud cases and is rarely the party that actually absorbs the loss. The contest is between issuer and merchant, and it is settled by the dispute process described in how chargebacks work.

The design principle is worth stating plainly, because it explains every specific rule: the network assigns the loss to whichever party failed to use the more secure available method. This is not a moral judgment about who was careless. It is an adoption incentive, and it has repeatedly worked as one.

The EMV liability shift

Before chip cards, counterfeit card fraud losses at the point of sale generally sat with the issuer. The EMV liability shift changed the rule: if a counterfeit transaction occurs at a terminal that does not support chip, the loss moves to the merchant. If the merchant supports chip and the issuer did not issue a chip card, the loss stays with the issuer.

The effect was to make terminal upgrades economically rational for merchants on a specific date rather than eventually, and counterfeit fraud at physical points of sale fell substantially in markets that completed the transition. The instructive part is what happened next: fraud did not disappear, it relocated to card-not-present channels where no chip is involved. Liability shifts move fraud toward the least protected channel rather than eliminating it, which is the single most useful thing to know when evaluating any new liability rule.

Card-not-present defaults

In card-not-present transactions, online and over the phone, the default sits with the merchant. A merchant who ships goods against a stolen card number generally absorbs the loss through a chargeback, losing both the merchandise and the transaction value, plus a dispute fee.

This asymmetry is why card-not-present fraud economics dominate merchant risk programs. The merchant carries the loss by default and must actively do something to move it, which is what the authentication protocols are for.

3-D Secure as a liability transfer

3-D Secure, deployed under brand names across the networks, authenticates the cardholder with the issuer during checkout. Its most important property is not that it stops fraud, though it does reduce it. It is that a successfully authenticated transaction generally shifts fraud liability from the merchant to the issuer.

That makes it an economic instrument rather than only a security control. Authentication introduces checkout friction, and friction costs conversion. The merchant's calculation is whether the fraud loss avoided plus the liability transferred exceeds the revenue lost to abandoned checkouts. For low-value, low-risk transactions the answer is usually no, which is why risk-based authentication, applying the challenge selectively based on a real-time risk score, became the standard approach rather than challenging everyone. The scoring infrastructure behind that decision is covered in real-time fraud detection in payments.

Two caveats matter. The protection applies to fraud-related disputes, not to disputes about whether goods arrived or matched their description, which remain the merchant's problem regardless. And issuers can decline to authenticate, in which case the merchant chooses between proceeding with liability retained or losing the sale.

ACH: The Return Window Decides

ACH allocates liability through a returns regime rather than a chargeback process, and the governing variable is time.

For consumer accounts, an unauthorized debit can be returned for up to sixty days from the statement date, and the consumer's bank makes them whole and pushes the loss back to the originating side. That is a long window and strong protection.

For business accounts, the window is two banking days. After that, the business generally owns the loss. The gap between sixty days and two days is the single starkest liability asymmetry in domestic payments, and it exists because the rules assume businesses reconcile their accounts promptly and can bear commercial risk.

The practical consequence is that ACH debit fraud against a business is close to unrecoverable unless caught almost immediately, which makes daily reconciliation a fraud control rather than an accounting nicety. It also explains why ACH debit blocks and positive pay filters, which instruct the bank to reject debits that do not match an approved list, are standard treasury controls rather than optional extras.

ACH credits, where the payer pushes money out, are different again. There is no return right for an authorized credit. If a business is deceived into sending an ACH credit to a fraudster, the transaction was authorized and the returns regime does not apply. Recovery depends on the receiving bank's cooperation and whether the funds are still there, which after a few hours they usually are not.

Real-Time Rails: Finality Is the Point

Instant payment systems settle in seconds and are irrevocable by design. Finality is the product feature, and it is also the fraud problem, because there is no window during which a mistaken or induced payment can be pulled back.

This produces the fraud pattern that now dominates policy discussion: authorized push payment fraud, where the victim is deceived into sending the payment themselves. An impersonator posing as a bank, a supplier, a landlord, or a family member persuades the victim to push funds to an account the fraudster controls. Every technical control performs correctly. The customer authenticated, the payment was authorized, the funds arrived. The customer was simply deceived.

Under traditional rules the victim owns that loss entirely, because unauthorized-transaction protections do not apply to a payment the customer authorized. As instant rails scaled, this became untenable at a policy level, and the United Kingdom moved first with a mandatory reimbursement regime for authorized push payment fraud, splitting the cost between the sending and receiving institutions rather than leaving it with the victim.

That model matters beyond its jurisdiction because it establishes a template regulators elsewhere are examining. The mechanism is what makes it interesting: by placing part of the loss on the receiving institution, it creates a direct financial incentive for banks to police the accounts that receive fraudulent funds, which is where mule accounts live and where the traditional allocation created no incentive at all. Any institution operating on instant rails should treat receiving-side liability as a plausible future state rather than a foreign curiosity, and the same question arrives with account-to-account payment methods generally, a dynamic examined in pay by bank and account-to-account payments.

Wires: The Loss Stays Where It Lands

Wire transfers are final, high-value, and carry the weakest reversal rights of any rail. Once executed and accepted by the receiving bank, a wire is effectively irreversible absent the recipient's cooperation or a rapid law-enforcement freeze.

This is precisely why business email compromise targets wires. The attack does not require compromising any payment system. It requires convincing a person with payment authority to send a legitimate wire to the wrong account, usually by impersonating an executive or a supplier and supplying updated banking details. Every control performs as designed, and the money is gone.

Liability sits with the originating business in almost all cases, because the payment was authorized by an authorized person. Banks that followed their agreed security procedures are generally not liable, and the disputes that do arise typically turn on whether the bank's procedures were commercially reasonable and actually followed, not on whether fraud occurred.

The only reliable controls are procedural, and they are unglamorous: out-of-band verification of any change to banking details using contact information from an existing record rather than from the request, dual authorization above a threshold, and a mandatory callback for first-time payees. The recovery path, if invoked within hours, runs through the originating bank requesting a recall and the receiving bank freezing whatever remains.

The Liability Map

The pattern across the table is consistent. Unauthorized transactions carry protection; authorized ones generally do not. Fraud has followed that line precisely, migrating from stealing credentials toward deceiving the account holder into moving the money, because the second approach lands on the side of the line where the victim absorbs the loss.

What This Means Operationally

Route with liability in mind

The rail is a risk decision as much as a cost decision. Paying a new supplier by wire places the entire loss on the payer if the details are wrong. A card payment on the same invoice carries dispute rights the wire does not, which is a real if partial recovery path and one reason virtual cards have gained ground in payables, discussed alongside their control properties in the broader interchange economics covered in interchange fees explained. The cheapest rail per transaction is not the cheapest once expected fraud loss is priced in.

Treat step-up authentication as an economic decision

Forcing authentication transfers liability and costs conversion. The right threshold is where expected fraud loss avoided plus liability transferred exceeds expected revenue lost to abandonment, and that threshold varies by transaction value, product category, and customer segment. Applying one blanket rule leaves money on the table in both directions: over-challenging low-risk traffic and under-protecting high-risk traffic.

Read the processor agreement for the exceptions

Network rules set the default; the processor agreement determines what a specific merchant actually faces. The clauses that matter are the chargeback ratio thresholds that trigger monitoring programs and their associated fines, whether the processor holds a reserve against disputes, how representment is supported, and what liability the agreement disclaims regardless of what network rules would otherwise assign. A merchant assuming network defaults apply without reading these has assumed something the contract may not say.

Reconcile daily, because the windows are short

The two-banking-day return window for business ACH debits converts reconciliation cadence directly into recoverable loss. A business reconciling weekly has structurally forfeited the protection.

Verify banking-detail changes out of band, always

The single highest-return control against the highest-loss fraud pattern. A change to supplier bank details, requested by any channel, verified by calling a number already on file rather than one supplied in the request. It stops the attack that liability rules will not remediate afterward.

The merchant and treasury playbook

The ordering principle across the table is that preventive controls outrank shifting controls on the rails where nothing shifts. On cards there is a liability transfer to buy, so the calculation is economic. On wires and ACH credits there is no transfer available at any price, which is why the controls that matter there are procedural and must be applied before the payment leaves.

Frequently Asked Questions

Who pays when a credit card is used fraudulently online?

The merchant, by default. In card-not-present transactions the merchant absorbs a fraud chargeback, losing the goods, the transaction value, and a dispute fee. The main way to move that liability is 3-D Secure authentication, which generally shifts fraud liability to the issuer when the cardholder authenticates successfully. It does not cover disputes about goods not arriving or not matching their description, which stay with the merchant regardless.

What is the EMV liability shift?

A change in card network rules making the party that did not support chip technology responsible for counterfeit card losses at the point of sale. A counterfeit transaction at a terminal without chip support becomes the merchant's loss; if the merchant supports chip and the issuer did not supply a chip card, it stays with the issuer. It drove terminal upgrades effectively, and it pushed fraud toward card-not-present channels rather than eliminating it.

Can an ACH payment be reversed after fraud?

It depends on the account type and the timing. A consumer can return an unauthorized debit for up to sixty days from the statement date. A business has two banking days, after which the loss generally stays with the business. An authorized ACH credit, where the payer was deceived into sending funds, has no return right at all, because the payment was authorized. Recovery then depends entirely on the receiving bank and whether funds remain.

What is authorized push payment fraud?

Fraud in which the victim is deceived into sending a payment themselves, typically to someone impersonating a bank, supplier, or executive. Because the customer genuinely authorized it, unauthorized-transaction protections do not apply and the victim absorbs the loss by default. The United Kingdom introduced mandatory reimbursement splitting the cost between sending and receiving institutions, a model regulators elsewhere are studying, notable for creating a receiving-side incentive to police mule accounts.

Why is business email compromise so hard to recover from?

Because it targets wires, which are final and carry the weakest reversal rights of any rail, and because the payment is authorized by a genuinely authorized person. No system was breached, so no system-level protection applies, and liability sits with the originating business. Recovery requires acting within hours through a bank recall request. The effective controls are all preventive: out-of-band verification of banking-detail changes, dual authorization above a threshold, and callbacks for first-time payees.

The Bottom Line

The single most useful reframing here is that fraud liability is a policy instrument, not a natural consequence. Card networks moved counterfeit losses to merchants to force terminal upgrades, and it worked. They offered liability transfer through authentication to drive adoption of 3-D Secure, and it worked. United Kingdom regulators moved part of authorized push payment fraud losses onto receiving institutions to create an incentive to police mule accounts, which no prior allocation had done. In each case the allocation was chosen to change behavior.

That has a direct implication for anyone building payment operations. Liability rules are not fixed background conditions; they are the most movable part of the system, and they move toward whichever party is best positioned to prevent the loss. The current direction is unmistakable: protection is expanding from unauthorized transactions toward authorized ones, and cost is being pushed onto receiving institutions rather than left with victims.

Organizations should build for that. Know who absorbs the loss on each rail they use today, price expected fraud loss into rail selection rather than comparing transaction fees alone, treat authentication thresholds as a tunable economic decision, and assume that the protections around authorized payment fraud will strengthen rather than remain where they are.