Basically everyone involved in payments has sort of an informal tax on them that they pay to reduce payment fraud. But since it's all informal, there's this co

Basically everyone involved in payments has sort of an informal tax on them that they pay to reduce payment fraud. But since it's all informal, there's this constant push-and-pull about whose responsibility is exactly to do what. The way that payment processors see it is that sites that accept payment's duty is to take enough precautions -- based on the nature of their business, the profile of their customers, etc. -- to keep fraud down to a relatively low level. And if your site is a magnet for fraud you've failed to be a good citizen and they're entitled to be harsh with you. They in return eat the primary liability for fraudulent payments -- that is, they may try to recover fraud from the sites, but it's anyone's guess whether they will be able to, while they themselves will always be on the hook for it. From the perspective of especially smaller sites, it can be like, "Wait, what? What were we supposed to do? How were we supposed to even know that people were using us for fraud?" There's definitely a lot of room for the payment processors to misbehave and push more liability onto the sites than is perhaps optimal.