Actually, in some cases the liability shifts to the customer:

  As few customers object to terms and conditions, banks are 
  free to set terms that shift liability to customers. For
  example, the Royal Bank of Scotland says [2]:

  “You understand that you are financially responsible for 
  all uses of RBS Secure.”

  So despite the bank having made many poor security choices,
  the customer must accept the losses – a clear example of 
  misplaced incentives. The use of password also harms 
  customer interests because they no longer have the 
  statutory protection afforded by signatures where, in the 
  UK at least, the law makes a forged signature void and thus
  prevents banks from using their terms and conditions to
  make customers liable for forged cheques. It has already 
  been documented that many banks used the move away from 
  manuscript signatures to make customers liable for fraud 
  [4].

See "Verified by Visa and MasterCard SecureCode: or, How Not to Design Authentication"

http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf

In other words, the customer gets both a user interface problem and a liability shift.

It is called in the trade "getting shafted"!