My liability in the case of a stolen credit card would no doubt be set out in my contract with the credit card issuer. The credit card company swallows the rest. In case of fraud, they are the ones who will suffer the losses at the hands of the rogue. I'm sure that some clever lawyer thought of that from the beginning, though, and their losses will be indemnified by the vendor who accepted the card from the rogue. After all, if the vendor accepts a card from a person not authorized to use it, it is the vendor's own action that has caused the loss.
Vendors accept that responsibility as part of the deal.
In the final analysis, then, it's the vendor who's taking the biggest risk, because in the case of a fraudulently-placed order they will have shipped their product long before the real owner of the credit card is notified of the purchase. Assumed the risk By placing its order form on the Internet, the vendor has assumed that risk in order to do business. Law firms have only recently started taking credit card payment for their client bills. Despite the fact that clients have long requested it, many lawyers still resist. The notion of a law firm becoming an Authorized Merchant for VISA or MasterCard seems repugnant to some lawyers, as if somehow it commoditizes the services they render, or diminishes their value.