Earlier quoted context omitted.
> Provided the merchant did not incur liability by doing something immensely stupid and insecure, the bank is on the hook. If the perpetrator is caught, they will pay restitution to the bank. Source? As someone who helps support an online credit card gateway, in my experience it is the merchant who has to shoulder the cost (plus an extra penalty fee) of the transaction. Perhaps there are different chargeback policies…
> The only system I've seen where the cost of a chargeback is on the bank instead of the merchant is if the merchant has setup 3D-Secure/Verified by Visa... Verified By Visa is a nightmare, and was killing conversion rates by up to 60%. [1] I'm not sure if it's still the case, but when it first came out Amazon refused to integrate it. [1] https://econsultancy.com/verified-by-visa-a-conversion-rate-...
... But even providing the option was a non-starter, because of how many different banks had completely broken systems. We ended up ditching the feature entirely.