What actually happens is with 3DS: a merchant gets liability shift. Liability resides with the issuer then. Whether you as a customer can be held liable for da

What actually happens is with 3DS: a merchant gets liability shift. Liability resides with the issuer then. Whether you as a customer can be held liable for damages depends on your jurisdiction and when you report your devices / credentials stolen.