It's because merchants tolerate a certain amount of fraud loss in order to reduce friction for the customer when making a payment. The same reason nobody ever checks you ID when you pay with a credit card in a store (unless you're in Vegas where they seem to do that, for some reason).