Every card payment settles one of two ways: through a secure, chip-driven EMV transaction, or through an older, less-protected non-EMV transaction. The difference sounds technical, but it decides who eats the loss when a card gets cloned, whether a terminal can legally process a sale in some markets, and how fast a business can start accepting contactless payments at all.
Industry estimates put global in-person EMV chip adoption well above 80% today, yet non-EMV acceptance still lingers in parts of the US market, and raises different questions in India, where regulation has already pushed most cards past the chip milestone. This guide covers how an EMV transaction works, where non-EMV transactions persist, what EMV Certification requires, and how SoftPOS is reshaping acceptance for payment teams in both markets.
What Is an EMV Transaction?
An EMV transaction is a card payment processed using the EMV (Europay, Mastercard, and Visa) chip standard, managed globally by EMVCo. Instead of storing account data on a static magnetic stripe, an EMV card carries a microprocessor chip that generates a unique cryptogram for every purchase.
When a customer inserts or taps a chip card, the terminal and its EMV kernel run a real-time exchange: the chip authenticates itself, the terminal decides on PIN, signature, or no cardholder verification, and an Authorization Request Cryptogram (ARQC) goes to the issuer for approval. Because that cryptogram is different every time, a captured EMV transaction can’t simply be replayed or cloned onto a blank card.
EMV transactions fall into two families:
- Contact EMV – the card is inserted into a chip reader (chip-and-PIN or chip-and-signature).
- Contactless EMV – the card, phone, or wearable is tapped near an NFC reader, using an EMV contactless kernel to complete the same cryptographic checks in under a second.
What Is a Non-EMV Transaction?
A non-EMV transaction is any card payment that skips chip-based dynamic authentication. The three most common forms are:
- Magnetic-stripe swipes – the terminal reads static Track 1/Track 2 data straight off the stripe.
- Manually keyed-in (MOTO) transactions – the card number, expiry, and CVV are typed in, common for phone and mail orders.
- Fallback transactions – the chip fails to read, and the terminal drops back to stripe or manual entry.
The core weakness is that stripe data doesn’t change between purchases. Anyone who copies it, through skimming, a data breach, or a compromised terminal, can reuse it or encode it onto a counterfeit card. With no per-transaction cryptogram to verify, a non-EMV transaction is inherently easier to defraud, which is exactly why card networks now assign fraud liability differently depending on which side of the EMV line a sale falls on.
EMV Transaction vs Non-EMV Transaction:
Factor | EMV Transaction | Non-EMV Transaction |
Authentication | Dynamic cryptogram, unique every time | Static data, identical every time |
Fraud risk | Low — captured data can’t be replayed | High — skimmed data is directly reusable |
Fraud/chargeback liability | Shifts away from the party using EMV | Often lands on whoever skipped EMV |
Typical hardware | EMV L1-certified reader + certified kernel | Magstripe reader, keypad, or CNP gateway |
Processing method | Insert, tap, or SoftPOS tap-on-phone | Swipe or manual key entry |
Global acceptance | Required across nearly every major market | Increasingly restricted or phased out |
The pattern holds everywhere: an EMV transaction pushes fraud risk toward whoever has the weaker technology in the chain, and a non-EMV transaction pushes it toward whoever didn’t upgrade.
Why the EMV vs Non-EMV Gap Still Matters in 2026
United States
The US completed its card-present liability shift back in October 2015: if a terminal can’t process an EMV transaction and fraud hits a chip card anyway, the merchant, not the issuer, typically absorbs the loss. A decade later, the card itself is catching up. Mastercard has committed to making magnetic stripes optional on new US cards starting in 2027, phasing them out of new issuance by 2029, and retiring them completely by 2033 (prepaid cards are exempt). In practice, any US business still leaning on non-EMV transactions, through aging terminals or manual key entry, is carrying liability the rest of the market has already shed.
India
India never had a long EMV transition to manage. The Reserve Bank of India required new debit and credit cards to be EMV chip-and-PIN and pushed banks to retire remaining magnetic-stripe cards years ago, so a non-EMV transaction is now the exception, not the norm. The bigger 2026 story is authentication: RBI’s updated digital payments rules require two-factor authentication on effectively all digital transactions, cap PIN-free contactless payments at ₹5,000, and mandate tokenisation instead of storing raw card numbers. Layer in RuPay and NCMC transit cards, and Indian deployments need EMV kernels certified across multiple schemes, not just Visa and Mastercard.
What Is EMV Certification?
EMV Certification is the formal process that proves a reader, kernel, or complete payment solution meets EMVCo’s specifications before it can process a live EMV transaction. EMVCo, owned collectively by Visa, Mastercard, Amex, Discover, JCB, UnionPay, and RuPay’s parent NPCI, organizes certification into three levels:
- EMV L1 Certification – tests the physical hardware: a chip reader or NFC antenna’s electrical and mechanical compliance.
- EMV L2 Certification – tests the kernel, the software that runs card authentication, risk management, and cryptogram generation, with each scheme (Visa, Mastercard, RuPay, and others) requiring its own approval.
- EMV L3 Certification – tests the finished terminal or app end-to-end against the acquirer’s host, confirming it’s actually ready to go live.
None of the levels can be skipped: L1 must pass before L2 means anything, and L3 depends on both. That sequence is usually the slowest, costliest part of bringing a payment product to market, which is why most manufacturers and fintechs license a pre-certified EMV kernel rather than build one from scratch. PCI PTS and PCI DSS certification typically run alongside it, since a device also has to prove it protects PINs and cardholder data.
SoftPOS: Accepting EMV Transactions Without Extra Hardware
SoftPOS (Software Point of Sale), often called Tap-on-Phone, turns an NFC-enabled Android smartphone into an EMV-compliant contactless terminal, no card reader, no dongle, no extra device. The phone’s NFC antenna reads the card or wallet, an embedded EMV L2 contactless kernel runs the transaction, and the result is processed like any other EMV transaction.
Because SoftPOS handles cardholder data on a consumer device, it answers to its own certification standard: PCI’s Mobile Payments on COTS (MPoC), which replaced the earlier SPoC and CPoC programs and covers roughly 190 individual security requirements, from the app layer down to the backend attestation service. Visa and Mastercard have both sunset their older proprietary pilot certifications in favor of PCI MPoC, so a SoftPOS product without it generally can’t go live on their rails.
Adoption is accelerating in both markets. In the US, Tap to Pay has gone from novelty to a default option for small and mobile sellers. In India, SoftPOS is pitched as the fastest route to EMV acceptance for the millions of small merchants who currently rely on QR codes or cash, without the cost of a dedicated POS terminal. One widely cited forecast expects global SoftPOS deployment to grow from around 6 million merchants in 2022 to more than 34 million by 2027. EazyPay Tech’s own SoftPOS stack pairs a certified EMV L2 kernel with white-box cryptography, remote key injection, and device attestation, the level of security PCI MPoC expects. For a deeper rollout guide, see our SoftPOS security checklist for banks and fintechs.
Moving From Non-EMV to EMV or SoftPOS: A Practical Checklist
For businesses or platforms still carrying non-EMV transaction volume, the path forward usually looks like this:
- Audit current acceptance methods. Identify which terminals, gateways, or manual-entry flows still fall back to non-EMV processing.
- Decide between hardware and software acceptance. A traditional EMV terminal suits fixed checkout counters; SoftPOS suits mobile, pop-up, or low-volume locations where a dedicated device isn’t worth the cost.
- Confirm scheme coverage. US deployments need Visa and Mastercard kernels; Indian deployments should add RuPay and NCMC if transit payments are in scope.
- Work with a certified partner. Licensing a pre-certified EMV kernel and pairing it with EMV Training & Consulting support can cut months off L1–L3 timelines.
- Test, launch, and monitor. Run L3 host-integration testing before go-live, then track fraud and chargeback data to confirm losses are actually dropping.
The Bottom Line
An EMV transaction and a non-EMV transaction can look identical to a customer a tap or swipe, a few seconds, a receipt — but they carry very different security guarantees and liability outcomes for the business behind the counter. In the US, that gap is closing as magnetic stripes get phased out card by card. In India, it’s already closed at the card level and has moved to authentication and multi-scheme certification instead. SoftPOS is the newest way to close it further, by putting a fully certified EMV transaction inside an app instead of a dedicated device.
If you’re building or deploying payment acceptance in either market, EazyPay Tech provides EMV L1–L3 certification support, scheme-specific kernels for Visa, Mastercard, and RuPay, and a PCI MPoC-ready SoftPOS stack, so certification work doesn’t sit on your roadmap longer than it has to. Contact our team or start an order to see what fits your rollout.
