According to this New York Times article
, the FTC has filed suit against scammers who placed more than $10 million in fraudulent charges on consumers’ credit and debit cards. The bogus charges weren't large. All were under $10, and each cardholder was only hit once which all allowed the scammers to go unnoticed for years.
Article has some useful info on the cardholder liability:
By law, consumers are liable for no more than $50 in fraudulent charges on a credit card and no more than $500 in fraudulent charges on a debit card, if reported by specified deadlines. But in practice, most major banks offer full protection from losses attributable to fraud. Someone must first identify the fraud, however.