No - not true. The merchant bears most of the risk. It's entirely wrong, and I'm amazed it's even legal, but that's how it is.
If you set up an online shop, you'll find that you are asked to take on the risk of fraud, yet you don't get the card number or card address from the purchaser. That means you have no reasonable way to verify if the purchaser is fraudulent - even if you had a list of all the stolen cards or whatever, you still couldn't make that judgement. Instead, the card company does that fraud check for you, and tell you the card is good to go. You'll then ship product, after which they come back to you to say "sorry, that card was stolen". They then take their money back off you, and you're left without product and without money.
I wonder if this sort of thing is even legal in the UK any more. Financial companies now have to treat customers fairly (under FSA/FCA rules), and I'm left wondering if this would hold up as "fair" if it was challenged. However, until such a time, the merchant is almost entirely liable for any card fraud.