The networks have a massive incentive to minimize fraud. That's not to say that they are wildly successful or anything, but I do know from first hand professional experience that card networks spend a lot of time, money, and research into detecting and preventing fraud.

- Payment networks drop accounts with a too-high fraud rate.

- They and similar businesses (e.g. Stripe) offer automated tools to deal with fraud… for a price.

Outcome: the incentive to minimize fraud, which is often a result of crap security from the payment network, is on merchants, who also get charged extra protection money to get payment networks to do stuff they ought to be doing in the first place.

Ultimately, that incentive is the legal system, which can legislate against allowing fraud and forcefully impose penalties for it. (And operating it is a socialized cost, such that your first sentence is still correct.)