(Yes, yes, the CC companies are on the hook for it, and you're not liable for any money charged to a stolen card, etc., etc., but it doesn't make it pleasant. It's stressful.)
The CC companies pass it down to the retailers in terms of transaction fees, who in turn pass it down to the consumers.
It doesn't matter whether your card gets stolen or not. It doesn't matter whether you even have a credit card or not. Everyone is paying for the cost of credit card fraud in one way or another. Even people who only pay with cash still bear the burden of credit card fraud, since they're still paying the credit-card-fee-inclusive price (unless they only shop at retailers with cash discounts).
Fraudulent charges are withdrawn from the retailers. Even if it has already posted to the bank account, they will take it back.
The CC companies never absorb the cost for fraud. Their greatest trick is convincing everyone they do.
In the end, consumers and businesses are on the hook for it.
I think this really depends on who you are. I find it pretty entertaining every time and enjoy trying to figure out where it was, knowing full well I just bitch at the bank and have little to no issue replacing the card.
Very.
Merchants are already 'holding the bag'... if they accept a fraudulent card for an order, the bank simply reverses the charge (and the merchant eats whatever they lost filling the order). So how does this change anything?
If chip and pin gets anywhere in the US, it'll be because of association requirements, not because they've pushed responsibility for one minute type of fraud on to merchants.
It's a lie. Why do you think so many stores ask to see ID?
From what I've seen, the accepting merchant account is always debited for every chargeback and the card issuers rarely bear any burden from fraud.
Yes, CC companies can do a better job of mitigating risk, but it's hardly a case to blame "only" them for this.
Then, when the fraud inevitably occurs--the crime as old as money itself--the credit card provider disclaims responsibility and places the onus upon the merchant.
The banking industry should arguably be a larger employer of top-tier cryptographers and cryptanalysts than the espionage and counter-espionage industry, but instead we get half-assed schemes from them like "How about we just print a secret code on the back of the card and don't write it to the magnetic strip?" Well, your helpful waiter then just swipes the card with his skimmer and photographs both sides before selling the info down the chain of fraud.
This is why new tech like digital blockchain currencies are coming into existence. The banks simply are not providing the level of service commensurate with the fees charged, and people are latching on to any available alternative, no matter how much it stinks, just because it is an alternative. Paypal, hawala, eGold, Bitcoin, Rixty, or whatever. People simply don't want to be vulnerable to a replay attack on their bank accounts. The market for credit card numbers and associated personal data would not exist if the issuers had a truly secure means of validating identity and authorizing payments instead of the hand-wavey pretend-secure system they already have in place on thousands of point-of-sale terminals.
That's why now, instead of the existing companies fixing the mechanisms that allow for fraud to take place, they can afford to ignore that market signal (that their product has a bug) by forcing their customers to pay for it (the retailers, who in turn force their customers, us, to pay for it).
This is how, in very real terms, the lack of competition literally hurts everyone, by making everyone pay for thieves, instead of making just incompetent private companies (trying to compete in this market) pay for it.