My wife had her credit card number stolen before... we bought alcohol at a store, months later they were burglarized and some how those credit cards made it from NJ to Russia, and people started charging up digital goods to resale. All of this was told to us by the Police after they finished their investigation along with the credit card company.
To answer your question, YES. They absolutely reimbursed us for 100% of the money that was taken from the account, the overcharge fees and they might have even gave is extra money for the issues. Once credit card companies are notified, they generally go to work and do all the leg work to get their customers money back. Aka, refunds.
No, you misunderstood me.
I have no doubt that the one owning the card will be reinbursed fraudulents charges. There're insurances involved there, and law protect the card owners. In fact, the card issuers prefer reimbursing people to up the security on cards, because it's expensive, and more important, it could become less easy to use a card, which could drive customers away from credit cards.
It's even more stupid when you see that some websites ask for the card number, the card holder name, the 3 additional digits and the card date, and only check the number (paiements are accepted even if all other informations are false). Of course that legit customers are reimbursed.
What I meant is... the sellers that sold goods to someone with a stolen credit card are not the ones that reimbursed the customers. The credit card insurance do.
In this case, Bethesda/Valve may have pocketed the money from the fraudulent paiements, kept it, and still invalidate the keys. If that's the case, I find that a bit shady.
(but I think that most digital business is shady, so that doesn't come as a surprise)