If someone books on my website with a stolen card, am I the one who loses the money?

Yes, in most cases the money comes back out of your account, not the airline's or the hotel's. When a card is charged on your website you are the merchant on that payment, so if the real cardholder tells their bank they never made the booking, the bank takes the money back from you. This is called a chargeback and it can arrive weeks after the travel has already been taken. The supplier has still issued the ticket or held the room, so they will expect to be paid either way.

The better news is that many of these bookings can be stopped before they cost you anything. Your portal can hold a booking for a manual check instead of ticketing it straight away, which gives you time to call the customer or ask for proof of the card. Travel that starts almost immediately, a card issued in a very different country to the traveller, and repeat attempts from the same person in one day are worth looking at first.

How much protection you have on the payment itself depends on your payment provider more than on the website. If your provider supports the extra step where the cardholder confirms the payment with their own bank, and it is switched on for every transaction rather than only some, the liability for a disputed booking usually moves away from you. Not every provider works this way, so please confirm it with them rather than assuming.

Ask your payment provider whether that cardholder verification step is turned on for all bookings, then tell us which bookings you want held for a manual check before they go to the supplier.