It depends on the merchant agreement, but merchants are often liable for the fraudulent charge, especially for online sales.

Sometimes the merchant does pay for a fraudulent transaction, and sometimes the issuing bank does. The credit card networks never pay. It depends on several factors including whether the card was physically present and whether it was swiped or used a chip.

This is just untrue though, my company has to eat the cost of fraudulent transactions and the burden is squarely on us to prevent it.

If you’re using Stripe or PayPal then yes it is the store owner who would be “picking up the bill”.