The liability for the card holder is limited by law to something like $50. Whether the credit card company eats the loss or wether the merchant gives them the money back depends I believe on how much information the merchant collected about the transaction. My impression is that usually the merchant eats the loss.