Imagine a scenario like:
1. Hacker steals credit card info. 2. He uses stolen card to buy virtual assets on Steam. 3. He sells these virtual assets to other unsuspecting players in exchange for PayPal. 4. <Possibly repeats steps 2-3 many times> 5. Leaves with remaining PayPal funds.
Here, who actually loses the money that the hacker gains? These are the options I see:
A. Owner of the credit card
He is responsible for the safety of his own account.
B. The bank that issued the card
Most banks have fraud protection, so they refund the card holder and accept the losses.
C. Valve Corporation (Company that runs the virtual platform)
Bank contacts Valve to refund the purchase (this seems unlikely to me), which Valve does.