If a malicious website steals my credit card info, what happens?

Question

Let's say I submit my credit card information to a website to purchase something. They give me a message saying the item will be delivered soon, and I don't notice anything wrong.

Later I find out that my credit card is being used for unauthorized purchases.

I believe my bank protects me against unauthorized use if I notify them. But:

1. Will the bank take a loss?
2. What happens to the malicious website and its owners? (Will it be hard to prove that the website is guilty?)
3. What happens to the other shops where unauthorized purchases were made with the stolen credit card information? Do they take a loss too?

If this depends a lot in jurisdiction, just give an overall idea or choose your favourite jurisdiction. If you happen to know how it would be in Brazil, please provide that too (but it is ok if you don't).

Answer 1

There are two fundamental forms of credit card transactions: card-present, and card-not-present.

Every transaction where the card's mag strip is swiped or embedded chip physically read, is a card-present transaction. Every internet transaction or over-the-phone transaction is a card-not-present transaction.

Not by law, but by contractual agreement, the fraudulent card-present transaction is absorbed by the card issuing bank (the card-holder's bank), and the fraudulent card-not-present transaction is charged back to the merchant account.

In both cases there is a review/dispute process wherein the charged entity can attempt to recover funds.

Answer 2

Being as general as possible - refund policies are governed by bank and scheme policies, and so aren't necessarily the domain of law. There may be jurisdiction-specific regulations that limit your liability as a consumer, but there's not usually a legal requirement.

1. This is almost certainly wholly governed by your credit card terms of use.¹
2. You can report this to your local authorities, but without proof of a crime, it's unlikely to be actionable.
   The website isn't necessarily to blame, either - if your computer or your connection to the website was somehow compromised, then your details may have been obtained in that way, and the website could have had nothing to do with it.
3. Again, this is almost certainly wholly governed by their scheme agreement.¹

---

_{1. Some off-topic information here, which may or may not be accurate, and which you should not seek clarification for here (check Money SE instead, and first check whether it is on-topic there) - generally, bank policies will refund you for fraudulent transactions below a certain quantity or value. In this case, the bank tends to take a loss and chargeback rights are not exercised.
In other cases, the bank will require the merchant to prove that the authorised cardholder did in fact authorise the transaction. The level of proof is governed by the way in which the transaction was conducted and verified at the time of purchase - whether the CVV2 code was verified, whether address verification was completed, whether 3D verification was completed. If the merchant is unable to prove, according to the scheme guidelines, the transaction will be charged back to their account.}