They are everywhere. Default liability for online payments is and has always been with the merchant; only 3DS and some wallets can shift it to the issuer.