Actually I'm fairly sure it's only legal for them to hold you responsible to ~50 dollars in case of ID theft. Don't you think the CC companies would want to make you liable? Of course they would.
These are the same banks that denied phantom ATM withdrawals were possible and prosecuted people who reported losses for bank fraud.
Within days of introducing chip+pin (where you enter your atm PIN at the checkout to use the debit card) it was discovered that pin readers at all Shell gas stations, and a couple of major supermarkets had been compromised and were logging all the card details and pin of your ATM card.
The T+C of the card claims that since you must have revealed your PIN to somebody it's your liability.
Until there was a massive public outcry.
In Switzerland, you get a 6-digit PIN, a chip in the card, and SecurID to log into online banking, but you are held responsible if unauthorized transactions go through.
