Actually the merchant is only liable for the loss if they did not follow all of the rules and regulations for processing the credit card.
From wikipedia (http://en.wikipedia.org/wiki/Credit_card_fraud#Merchants):
"The liability for the fraud is determined by the details of the transaction. If the merchant retrieved all the necessary pieces of information and followed all of the rules and regulations the financial institution would bear the liability for the fraud. If the merchant did not get all of the necessary information they would be required to return the funds to the financial institution. This is all determined through the credit card processory."
From what I have seen, it is very common for the merchant to be liable for losses on a card not present transaction (e.g. online retail) but the credit card company stomaches the losses for a card present transaction.
I suspect that online merchants could reduce their liability by implementing things like Verified by Visa but choose not to because it causes them to lose too many legitimate sales.
From wikipedia (http://en.wikipedia.org/wiki/Credit_card_fraud#Merchants): "The liability for the fraud is determined by the details of the transaction. If the merchant retrieved all the necessary pieces of information and followed all of the rules and regulations the financial institution would bear the liability for the fraud. If the merchant did not get all of the necessary information they would be required to return the funds to the financial institution. This is all determined through the credit card processory."
From what I have seen, it is very common for the merchant to be liable for losses on a card not present transaction (e.g. online retail) but the credit card company stomaches the losses for a card present transaction.
I suspect that online merchants could reduce their liability by implementing things like Verified by Visa but choose not to because it causes them to lose too many legitimate sales.