This is why large e-commerce companies have giant fraud departments trying to prevent fraudulent orders and charges on their site; because when they occur, they generally just eat the loss.
From wikipedia (http://en.wikipedia.org/wiki/Credit_card_fraud#Merchants): "The liability for the fraud is determined by the details of the transaction. If the merchant retrieved all the necessary pieces of information and followed all of the rules and regulations the financial institution would bear the liability for the fraud. If the merchant did not get all of the necessary information they would be required to return the funds to the financial institution. This is all determined through the credit card processory."
From what I have seen, it is very common for the merchant to be liable for losses on a card not present transaction (e.g. online retail) but the credit card company stomaches the losses for a card present transaction.
I suspect that online merchants could reduce their liability by implementing things like Verified by Visa but choose not to because it causes them to lose too many legitimate sales.