Oh yeah. I should definitely caveat: I am in the US. I think banks here are required to cap your loss to $50 USD if you report unauthorized fraud within two business days. But still, the onus is on you. Meanwhile, virtually all credit cards in the US offer $0 liability protection. Which means at most you pay nothing.