Banks are under no obligation to issue a credit, even with Visa's no liability policy. Also, I believe a bank has 45 days under law to investigate reported fraud during which time you may have to do without the money that was stolen.

From their policy (emphasis mine):

"Visa's cardholder protection policy requires all financial institutions issuing Visa products to extend provisional credit for losses from unauthorized card use within five business days of notification of the loss. However, many major financial institutions affiliated with Visa will issue provisional credit even earlier—within 24 to 48 hours after the loss is reported."

Bounced checks, late payments and other nasty surprises may cascade as a direct result of this once incident and that's not the bank's problem.

Again, from their statement of the policy:

Should someone steal your card number while you're shopping, online or off, you pay nothing for their fraudulent activity.

As an issuer of Visa products, banks are bound to Visa's rules in these matters and really don't have a choice about whether to refund bounced-check fees etc. This does not mean that someone may have to fight with them about it on occasion.

As you point out, they could change this policy in the future, of course, because these safeguards are not legally required of them. Still, this policy has been in place substantially unchanged for almost five years, so it's likely it'll be there for a while.

-- Mark