EMV chips create a unique code for each transaction, making it nearly impossible for thieves to use a stolen card number

An EMV chip is a small metallic square embedded in your credit or debit card that generates a one-time security code every time you use it. That code is different for every single transaction — even if someone steals your card number, they cannot reuse it because the code changes. A magnetic stripe, by contrast, stores the same information every time, so a thief who copies your number can use it repeatedly.

This difference matters because card-present fraud — where a thief physically uses your card or a cloned copy — dropped sharply after chip cards rolled out in the United States around 2015. Counterfeit card fraud fell by roughly 66 percent between 2015 and 2018, according to data from the payment networks. Thieves shifted tactics to card-not-present fraud (online and phone purchases) instead, which chips do not prevent, but the physical card itself became much harder to exploit.

You do not need to do anything to benefit from a chip card. The security works automatically when you insert the card into a chip reader or tap it on a contactless terminal. The card and the terminal communicate directly, and the chip generates that one-time code without ever sending your full card number across the network.

Key Takeaways

  • EMV chips generate a unique code for each transaction, so stolen card numbers cannot be reused the way they can with magnetic stripes.
  • Chip cards reduced counterfeit card fraud significantly after 2015, though thieves adapted by shifting to online and phone purchases instead.
  • You use a chip card the same way you use any other card — insert it into a reader or tap it on a contactless terminal — and the security happens automatically.
  • Chip cards work alongside other fraud protections like purchase monitoring and zero-liability policies, not instead of them.
  • Older magnetic-stripe-only cards are still in use but carry higher fraud risk, especially when used in person at unfamiliar merchants.

How the chip generates a code that changes every time

When you insert a chip card into a terminal, the card and the reader perform a handshake — they exchange information to verify the card is real and that you are authorized to use it. During this exchange, the chip creates an unpredictable code called a transaction cryptogram based on the transaction amount, the merchant, the date, and other details unique to that moment.

That cryptogram is sent to the payment network along with your transaction, but your actual card number is not. The network uses the cryptogram to verify the transaction is legitimate. If a thief somehow obtained your card number and tried to use it online or over the phone, they would not have the cryptogram — it only exists for that specific transaction at that specific terminal. A new transaction would require a new code, and the thief cannot generate one without the physical chip.

Magnetic stripes, by contrast, store a static copy of your card data. When you swipe, the same information goes out every time. A criminal who copies that data can use it repeatedly until you notice and report the card stolen. This is why older cards and cards from countries that have not yet adopted chips remain targets for cloning and counterfeiting.

Why chip cards reduced in-person fraud but not online purchases

Chip technology specifically protects against counterfeit card fraud — when a criminal creates a fake physical card using stolen data. Before chips, a thief could clone your card by copying the magnetic stripe and then use the fake card in stores. Chip cards made this nearly impossible because the chip cannot be duplicated; it is a secure microprocessor, not just data on a stripe.

Online and phone purchases are not protected by chips because there is no physical card involved. When you buy something on a website or call a merchant, you type in your card number, expiration date, and CVV code — the same information a thief could use if they obtained it from a data breach or phishing attack. The chip never enters the picture. This is why card-not-present fraud actually increased after chip adoption: criminals simply moved to the channel chips could not defend.

To reduce online fraud, the payment networks introduced 3D Secure (also called Verified by Visa, Mastercard SecureCode, or similar names depending on your card issuer). This system sends you a code via text or app when you make an online purchase, adding a second verification step. But this is separate from the chip and requires the merchant to support it.

What happens if you use a chip card at a magnetic-stripe-only terminal

Some older terminals and certain merchants — gas stations, vending machines, some international locations — still only accept magnetic stripes. If your card has both a chip and a stripe, the terminal will read the stripe instead. You get the same security level as a magnetic-stripe card at that moment, which means your full card data is transmitted and a thief could theoretically copy it.

This is one reason to stay alert at gas pumps and ATMs: they are often targets for skimming devices because many still use magnetic-stripe readers. If you notice a loose or unusual-looking card slot, use a different pump or machine. Most gas stations have upgraded to chip readers, but not all.

Your card issuer monitors your account for suspicious activity regardless of whether the transaction used a chip or stripe. If fraud does occur, you are typically not liable for unauthorized charges under federal law, though you should report them promptly to your bank.

Contactless and mobile payments add another layer

Many chip cards also support contactless payments — you tap the card on a terminal instead of inserting it. This uses the same chip technology and generates the same one-time code, but it is faster and reduces the time your card is out of your hands. Some terminals also accept mobile payments like Apple Pay or Google Pay, which use tokenization: your actual card number is never shared with the merchant at all. Instead, a unique token specific to that phone and that merchant is sent.

Contactless and mobile payments are generally considered more secure than inserting a physical card because there is less opportunity for a skimming device to intercept your data. However, they require the terminal to support them, and not all merchants have upgraded yet.

Chip cards work alongside other fraud protections, not instead of them

EMV chips are one layer of security, but they are not a complete solution. Your bank also monitors your account for unusual spending patterns — large purchases in unfamiliar locations, multiple transactions in a short time, or purchases that do not match your typical behavior. If the system flags something, your bank may decline the transaction or contact you to verify.

You also have zero-liability protection under federal law and most card issuer policies. If someone uses your card without permission, you report it to your bank and you are not responsible for the fraudulent charges (though you may have to wait while the bank investigates). This protection applies whether the fraud involved a chip, a stripe, or an online purchase.

The chip makes fraud harder to commit, but it does not make it impossible. Thieves have adapted by targeting online purchases, account takeovers (where they change your password and lock you out), and social engineering. Protecting yourself also means using strong passwords, checking your statements regularly, and being cautious about what information you share.

Older cards without chips still carry higher risk

If you still have a card with only a magnetic stripe and no chip, your bank may offer to replace it at no cost. Some banks have stopped issuing stripe-only cards entirely. If you travel internationally, a chip card is especially important because many countries outside the United States have required chips for years and some merchants may not accept stripe-only cards at all.

Stripe-only cards are still functional and still protected by fraud monitoring and zero-liability policies, but they expose you to higher risk of counterfeit fraud in person. If you use one regularly, pay closer attention to where you use it — avoid unfamiliar merchants, gas pumps with visible damage, and situations where the card leaves your sight.

Frequently Asked Questions

Can someone use my chip card number if they steal it online?

Yes. The chip only protects against in-person counterfeit fraud. If your card number is stolen from a website breach or phishing attack, a thief can use it for online and phone purchases. Your bank's fraud monitoring and zero-liability protection will catch most of these, but you should still report the theft promptly and consider replacing the card.

Is it safer to insert the chip or tap the card?

Both use the same chip technology and generate the same one-time code, so the security is equivalent. Tapping is faster and keeps your card in your hands longer, which some people prefer. Either method is secure.

What if a store's chip reader is broken and asks me to swipe instead?

Swipe the card if that is the only option — the transaction will still go through and your bank will still monitor it for fraud. However, if this happens repeatedly at the same store, you might ask the manager when they plan to fix the reader. Broken chip readers are a security weak point that merchants should address.

Do I need to do anything special to use a chip card?

No. Insert the card into the reader when prompted, or tap it on a contactless terminal. Leave it in the reader until the transaction completes. The security works automatically — you do not need to enter a PIN or take any extra steps (though some transactions may require a PIN for additional verification).

Will my old magnetic-stripe card stop working?

Not immediately. Most merchants still accept magnetic stripes as a backup. However, some card issuers have stopped renewing stripe-only cards, so when yours expires, the replacement will likely have a chip. If you want to upgrade sooner, contact your bank and they can usually send a replacement at no cost.