It's been a while, but I seem to recall in a past company that for card-not-present transactions, the risk of fraud was on us, not on the bank approving the transaction.