The bank, most likely, or their insurance provider. Deoending on US law (which protects people less than the UK AFAICT) the customer may have some liability. But basically the bank OK'd the transactions so it's on them.
Of course if it's that frickin' obvious what's going on then the merchant will find themselves under review and saddled with much higher fees after a while.
The merchant may be liable - but the minimum wage clerk...?
Minimum wage clerk is not liable due to many laws that protect employees from wage abuse without a judgement in court[1] but they can surely get fired for negligence in reporting suspicious activity.
[1] http://www.seyfarth.com/dir_docs/publications/NEHT01120810.p...
>As a practical matter, the Court’s decision means that employers can- not safely take deductions for theft or damage to property unless fault and value have been determined by a court of law or government agency.
Isn't the merchant liable for the chargebacks? Or in this case, who was footing the bill for this fraud?