Fraud liability usually falls on the business. Maybe the credit card companies shoulder the responsibility in some cases but I think its unlikely.
This the way card networks have encouraged migration to systems that support tokens and cryptograms to limit fraud.
See https://www.creditcards.com/credit-card-news/understanding-e...
For card-not-present transactions (i.e., all online credit card transactions) the liability is the merchant's. There is no recourse for a merchant who is a victim of a stolen card, the money is simply removed from their account.