They set APRs, fees, etc. to absorb it. The cost is, ultimately, borne by all of us, in either scenario.
I'm not advocating that individuals be held responsible for credit card fraud. I think the current setup is probably the best - the folks with the most ability to smooth out the losses (the banks) have most of the liability.
I'm simply objecting to the "The general populace has no reason to care" statement up-thread. That we're not directly liable for the fraud doesn't mean we're not getting screwed financially by it.
It's no different as an abstract concept than Boeing purportedly sacrificing hundreds of people to try to produce a 0.1% higher ROI. In general, you optimize a number that describes a large system, and you have to consider that there may be tradeoffs - things may get...lumpy.
It's not so much evil as that people have jobs that involve optimizing certain numbers and certain related consequences are outside their purview.
A quantitative improvement could mean implicitly taking away insurance that was gratis.