Mastercard Reason Code 4871: Chip/PIN Liability Shift

What Mastercard reason code 4871 means

4871 is the PIN counterpart to 4870. It’s a fraud code for transactions on a genuine card that was lost, stolen or never received by the cardholder, where the card was set up for chip and PIN but the transaction went through without PIN verification because the terminal couldn’t support it.

The logic is the same liability shift: PIN stops a thief who has the physical card but not the code. If your terminal couldn’t ask for the PIN when the card supported it, the issuer can pass the fraud loss back to your side. Which transactions qualify depends on regional rules, the card’s verification settings and the type of terminal, and it applies more in markets where PIN is the normal way to verify chip cards.

Does 4871 affect ecommerce merchants?

Rarely. There’s no PIN pad in an online checkout, and card-not-present fraud is handled through 4837 and 4863. Online merchants only meet 4871 if they also run in-person sales on terminals that can’t take a PIN.

Common causes

• Terminals without a PIN pad, or with PIN entry disabled
• Mobile readers that support chip but not PIN
• Unattended kiosks configured for signature or no verification
• Staff overriding a PIN prompt
• Merchants in tourist areas accepting foreign chip-and-PIN cards on terminals set up for local habits

Evidence that wins a 4871 dispute

1. Cardholder verification method from the authorization showing the PIN was entered and verified.
2. Terminal capability data showing the device was PIN-capable.
3. Card profile: evidence the card did not require PIN, so no PIN-based shift applies.
4. Transaction type exemptions: for example, contactless transactions under local limits, where rules differ.
5. Fraud-reporting status, since issuers are generally required to report fraud before charging back.

How to prevent 4871 chargebacks

• Use terminals with PIN entry enabled, including mobile readers if you sell at events.
• Don’t override PIN prompts for convenience.
• Keep terminals updated and configured to the card’s preferred verification method.
• Train staff on what a PIN prompt bypass costs.

Should you fight or accept?

Fight when your logs show PIN was verified, the terminal was PIN-capable, or the card didn’t require PIN. The case is decided by data, so pull the authorization record before anything else.

Accept when the terminal couldn’t take a PIN and the card was reported lost or stolen. That’s the outcome the liability shift is meant to produce, and the fix is the hardware, not the response.