> Provided the merchant did not incur liability by doing something immensely stupid and insecure, the bank is on the hook. If the perpetrator is caught, they wi

> Provided the merchant did not incur liability by doing something immensely stupid and insecure, the bank is on the hook. If the perpetrator is caught, they will pay restitution to the bank. Source? As someone who helps support an online credit card gateway, in my experience it is the merchant who has to shoulder the cost (plus an extra penalty fee) of the transaction. Perhaps there are different chargeback policies for card present transactions for physical products, but for online (and therefore card not present) transactions for digital products, I have always seen the merchant have to cover the cost of the chargeback (plus fee). There's a process for disputing the chargeback, saying the customer absolutely made the purchase and got what they were asking for, but almost every time the card would side with the customer, because there was no physical product. This is one of the reasons when card companies pushed for chip cards, merchants pushed back for chip and pin like cards used in Europe -- to cut down on fraud, which they end up paying for. The only system I've seen where the cost of a chargeback is on the bank instead of the merchant is if the merchant has setup 3D-Secure/Verified by Visa with their products, giving the banks and card companies the opportunity to have an extra login for making the purchase. However, those verify pages are made by the bank, not the credit card company, and are widely unreliable. I tried to set it up for our payment gateway, only to find that some of the banks had completely broken systems for it, leaving customers at an error page instead of buying the product.