Re: Liability
The banks and creditcard providers must be bearing a fair whack of the cost of this where they're the ones required by law to reimburse consumers.
Nope. Not how credit cards are wired, it goes like this: Credit card providers do not pay out any money they don't have and even then only after 3-4 months after the transactions were made.
A fraudulent transaction is therefore 'just' cancelled, sticking the merchant, who accepted the transaction with the losses - on top of the 3% service charge. Debit cards, OTOH, transfer the money directly so only Swedish* and straight-up idiots use debit cards on the Internet or while travelling!
The credit card provider simply runs a ledger recording the credit card transactions, at this stage presumably all authorised by the cardholder.
At the end of 'month 01', the credit card provider presents the ledger from 'month-00' to the cardholder.
Cardholder approves the ledger by paying it in part or full OR cardholder rejects transactions that cardholder claims are fraudulent. Cardholder has almost one month to pay the credit card provider.
The credit card provider now goes to the merchant accounts from where the fraudulent transactions were created and requests that the merchant proves that those transactions were correctly authorised by the actual cardholder. If the merchant cannot convince the credit card provider that the transactions are genuine and made by the cardholder, the credit card provider will remove that entry from the ledger and bump a 'fraud-metrics' against the merchant. If that metric goes high enough the merchant will lose access to credit card transaction clearing - for almost ALL cards, globally, because there exists a global credit card issuer cartel against scam-prone merchants.
Now, at 'month-03', the credit card provider has got the money for 'month-01' from the cardholder and at the end of 'month-03', they run down the ledger now containing only valid transactions and transfer the funds to the merchants.
I.O.W: Amazon will be stuck with the fraudulent charges. Too many of those and/or too much lip about not eating their losses willingly and they can lose their credit card facilities, temporarily or permanently.
*)
The Swedish banks for some obscure reason only offers 'Debit Cards linked to an account with an overdraft facility' marketed as 'Credit Cards' to the unsuspecting upcoming victims of credit card fraud. This of course causing an unpleasant discussion between the bank where the overdrawn account resides and cardholder on who gets to eat the loss.