The fraud is ultimately paid for by the userbase (cardholders and merchants) as a whole through paying fees. (Of course, whether a reduction in fraud cost results in a decrease in fee burden or an increase in issuer profits...)