Online merchants and payment providers may, in fact, need to reconsider whether finality or non-repudiation of payments should always be the primary goal with respect to online payment mechanisms. The Merchants Concern One of the main concerns of many online merchants appears to be finality or non-repudiation of payments. Generally they will have to bear the risk of loss in the event of such unauthorised use of credit card data. One condition for imposing even this limited liability on the cardholder, however, is that the card issuer has provided a means to identify the cardholder, such as a signature, photograph, or fingerprint on the card. As between card issuer and merchant, contractual agreements typically shift the risk of an unauthorised use absent a physical presentation of the card and absent a sales slip signed by the card user to the merchant.
European law leads to the same result.
8 of the European Distance Contracts Directive addresses payments by card. Thus, in the event of an unauthorised use of credit card data the consumer can only be held liable if her negligent conduct caused the misuse. However, the transmission of credit card data over the Internet, even over insecure channels, cannot be deemed to constitute negligent behaviour on the part of the cardholder. Consequently, as in the U.S., the European cardholder is generally not liable for an unauthorised use of her card data in online transactions. And as in the U.S., contractual agreements between card issuer and merchant ultimately allocate the risk to the merchant.