Ah yeah, but many issuers push it down to the consumer, basically the same case as when you've given the card PIN away.