That would be whoever made the cards fault. We don't give credit for cleaning up your own mess, that's the minimum standard for engaging in a beneficial relationship.

It's not a value proposition from gmail that you can't access my inbox just from knowing my address.

I can't believe you can be a $400B company and the value comes from stopping fraud that you enabled by your own product design.

Much of the fraud is merchants defrauding their customers.

Nah.

They took care of it for themselves, when someone commits fraud it isn't your problem because they used your name to do it.

Imagine if you were defrauded for a few hundred bucks by someone claiming to be a big celebrity. You probably wouldn't even be able to get into contact with the actual person, let alone have them jump through a bunch of hoops, spend time on hold with your staff or go to the post office to send you copies of documents. They wouldn't bother to respond to you, they have no obligation to, whatever happened had nothing to do with them.