That would be whoever made the cards fault. We don't give credit for cleaning up your own mess, that's the minimum standard for engaging in a beneficial relationship.

It's not a value proposition from gmail that you can't access my inbox just from knowing my address.

I can't believe you can be a $400B company and the value comes from stopping fraud that you enabled by your own product design.