It is always the merchant who ends up paying (by lost goods and services) for the fraudulent use of the card. My company has learned how to prevent it through the school of hard knocks, but many establishments don't employ robust prevention methods and that just allows the abuse to continue.