The liability is usually with the card issuer (bank), unless the merchant fails to meet liability shift requirements - like processes a card via the manually entered numbers or magstripe, rather than the chip in the card if the terminal supports it.

This the way card networks have encouraged migration to systems that support tokens and cryptograms to limit fraud.

See https://www.creditcards.com/credit-card-news/understanding-e...