[vaksel]

there are actually a ton of costs for them.

They have to pay for infrastructure, they have to pay for customer support, they have to pay for fraudulent transactions and on and on. I think most credit card companies have something like 10%-15% ROI

[armen52]

Their fraud costs are not what you make them seem. The credit card companies do not take on the risk for fraud most of the time. They push that risk onto the merchants.

This is why large e-commerce companies have giant fraud departments trying to prevent fraudulent orders and charges on their site; because when they occur, they generally just eat the loss.

[Aleran]

Actually the merchant is only liable for the loss if they did not follow all of the rules and regulations for processing the credit card.

From wikipedia (http://en.wikipedia.org/wiki/Credit_card_fraud#Merchants): "The liability for the fraud is determined by the details of the transaction. If the merchant retrieved all the necessary pieces of information and followed all of the rules and regulations the financial institution would bear the liability for the fraud. If the merchant did not get all of the necessary information they would be required to return the funds to the financial institution. This is all determined through the credit card processory."

From what I have seen, it is very common for the merchant to be liable for losses on a card not present transaction (e.g. online retail) but the credit card company stomaches the losses for a card present transaction.

I suspect that online merchants could reduce their liability by implementing things like Verified by Visa but choose not to because it causes them to lose too many legitimate sales.