Feels like one of those things where law is too stagnant to catch up with tech and should generally be considered fraud/theft when investigation shows it's actually the card holder or someone connected to them. :/