The bank, most likely, or their insurance provider. Deoending on US law (which protects people less than the UK AFAICT) the customer may have some liability. But basically the bank OK'd the transactions so it's on them.

Of course if it's that frickin' obvious what's going on then the merchant will find themselves under review and saddled with much higher fees after a while.