In particular, it turned out that there was a flaw in the Chip and PIN specification which made it possible to bypass the PIN requirement. There's some evidence this was exploited fairly widely in the wild before security researchers found the flaw, but since the banks erased the logs that recorded whether a PIN was actually used all the customers ended up liable for the fraudulent charges.