The issuer is responsible for properly validating the payment. If there is a fraudulent withdrawal, whether that is due to an internal fraud at the issuer or because some outside "hacks" an account, it is the issuer which is responsible for the loss. The consumer, of course, is made whole by the bank from which the withdrawal is made.