>If a stolen card is used to make a purchase, why is the merchant on the hook for this?

Did they confirm the identity of the person matches the card?

If the merchant has no liability, if opens up a whole world of new fraud.