Originally Posted by
tmiw
According to US law, it's still on the issuers to prove it:
http://www.law.cornell.edu/uscode/text/15/1643. Without this law, they would have probably tried to pin the charges on you anyway even if magstripe. Also, some of the current chip and PIN vulnerabilities are no longer an issue if online PIN is used instead of offline PIN.
I understand that. The question is, what constitutes proof? I believe that in other jurisdictions the fact that a PIN was entered is considered sufficient proof that the use was authorized.
I am not saying that this will happen here; I'm just saying that the belief that something is secure when it is not can lead to things like that happening.