If the theives are authorized to process the credit card, then the credit card company better have legit information about the company. If not, then does that open up the company to a lawsuit from ID theft victims?

If the credit card company accepted falsified information from a "company", then is the credit card company to blame if the ID theives are not caught?