I think it's a bit more nuanced than that. You have credit card companies offering a service that's easily abused and then charging companies for accept their credit card service for their lack of fraud protection. As an online only platform, you don't have much choice other than to accept credit cards. It seems like it'd be so trivial to enact measures to reduce this type of fraud. My credit card company frequently sends me an SMS whenever I try to use my credit card on OVH.com, I suspect as a result of frequent fraud on their website.