The chip still provides a "track 2 equivalent" to the terminal - http://www.emvlab.org/emvtags/show/t57/ http://www.emvlab.org/emvtags/show/t57/ If an attacker

The chip still provides a "track 2 equivalent" to the terminal - http://www.emvlab.org/emvtags/show/t57/ http://www.emvlab.org/emvtags/show/t57/ If an attacker intercepts that, they can get the account number from it and potentially use it for online purchases. But they wouldn't have the postal code or security code, which most but not all ecommerce merchants require. It's a rather flawed system - there are strict protections around certain cardholder data like PINs, but none of that really prevents fraud since just the account number is enough to make certain purchases.