It actually depends on whether you're in a card-present or card-not-present situation. For historical (i.e. irrational) reasons, merchants are responsible for fraud in the CNP situation.