The financial institutions were in no hurry to tighten standards because of a little-known fact: retailers, not banks, generally absorbed losses caused by identity thieves wielding pilfered credit card numbers. Many identity theft victims didn’t have to pay for the charges or loans made in their names. Visa and MasterCard covered the expenses, then passed them back to the businesses where goods were sold to the wrong person. That setup ensured that the credit card companies, which were often thought to be absorbing losses, actually earned money from many instances of fraud.
