Almost all of us have at least one credit card in our wallet.
Now imagine that you lost your wallet, and all of your cards were inside it.
Someone with bad intentions found your wallet and wanted to use the cards inside it.
Can this person carry out a transaction with the cards without a PIN?
Yes, they can. There are two possible ways this can happen.
1. Shopping at an online merchant that does not support 3D Secure transactions.
2. Making an in-person transaction at a POS terminal in a store without entering a PIN.
Let's assume the scenario described in item 2 takes place. The person with bad intentions went to a store. They did their shopping and came to the counter to pay. They handed over the card they found in the wallet. At the stage where the PIN would normally be requested, the transaction was completed without a PIN using PIN bypass. They left the store with the receipt showing the transaction was successful, along with the product they had purchased.
The real owner of the card, unaware that the transaction had taken place, checked their statement and saw this transaction that they had not made. They called their card's bank and reported that the transaction was not theirs.
So what happens now? Can the cardholder request a refund of the transaction amount? Or should they just accept the loss?
Let's start by stating this clearly: in a transaction carried out without a PIN, the liability belongs to the merchant. If a transaction is completed without a PIN being entered, a signature field appears on the receipt. In this case, the merchant's staff is obligated to verify the customer's identity and signature. If the merchant completes the transaction without verifying identity and signature, the cardholder's dispute to the issuer is forwarded by the issuer to the acquirer, and by the acquirer to the merchant. The relevant amount is then collected from the merchant. The acquirer refunds this amount to the issuer, and the issuer, in turn, refunds the corresponding amount to the cardholder.
In conclusion, in a transaction carried out without a PIN, the liability belongs to the merchant. The merchant is obligated to verify identity and signature.
