Yes, the merchant takes the hit if it's 'CNP' (cardholder not present - ie over the phone or internet)
If it's chip & pin, the card company take the hit, but......... if you get hit a few times too many with fraud they'll take your card machine away as you're not worth doing business with. So...