Because that is how we've decided to allocate the risk. There was a time when that allocation was different (and that users could be more liable for fraudulent use of their cards), but, at least in the U.S, we decided we didn't like that and legislated it away.