Early on the customers were completely liable because the banks claimed that the only wait a fradulent charge could be made is if the customer "allowed" their PIN to get stolen. Eventaully they changed this and made it more customer friendly.