The card company checks whether the card and terminal are EMV capable. But, the whole card system is not built on absolute security but on risk-management and f

The card company checks whether the card and terminal are EMV capable. But, the whole card system is not built on absolute security but on risk-management and fraud detection, that is somehow balanced with customer convenience. In effects this means that only thing that is absolutely needed for transaction to be authorized is card number, what other data have to be provided and what checks have to pass is function of trustworthiness of various parties involved (mainly of the merchant). (for example, the EMV standard explicitly handles various failure modes like "PIN-pad is broken", "card holder does not remember PIN" and so on, and allows configurations that accept such transactions)