That depends. For “card present” transactions, generally conducted in-store, if the merchant follows the process correctly, they are not liable for fraudulent purchases. The cardholder’s issuing bank is. For “card not present” (CNP) transactions that occur online (or other non-present channels, like mail), where the merchant is unable to confirm the identity and validity of the purchaser in-person, the merchant is liable for fraudulent orders and the cardholder’s issuing bank will collect the customer’s refund from the merchant should a cardholder request a chargeback. If the merchant processes a large volume of fraudulent orders, and thus receives a large number of chargebacks relative to their orders, their acquiring bank will likely take steps to raise fees to penalize the merchant. https://www.signifyd.com/resources/fraud-101/why-liable/