I don't own a credit card but read much about fraud with stolen credit cards. Since I don't own one, I don't know how you exactly buy online using your credit card, so please correct me, if I am wrong (and I hope so).


Customer choses articles in online shop and puts them into shopping
cart.
Customer goes to the virtual check out.
Customer enters delivery address and his cc data(?) and sends them to the server of the shop owner.
Shop server sends the cc data the customer entered and his data and the amount to the cc card server and receives the money.
Customer receives bought articles.
The shop owner wasn't very honest and uses the cc data the customer entered to shop on other online shops (especially
non-trackable goods like software licenses, ...). Since the data is
the same for all shops, nobody knows which shop misused the cc data.


Why not use an one-time authentification code or token instead? For example the customer enters the cc data on the server of the cc company which sends a confirmation to the shop owner or gives a signed token (like gpg) which the user gives the shop to prove he sent the money or the shop just waits till it sees the money on its account?
Since I have basic it-security knowledge you might also add technical details.
So are my assumptions right and if so, what prevents web shop owners from misusing credit card data?

The liability for a disputed transaction falls upon the merchant for Card-Not-Present transactions.  Essentially, if you dispute a transaction, if the merchant doesn't have your signature, then if you persist they will end up footing the bill.  By the same token, when a CNP merchant double bills you, they're going to end up paying when you dispute the bill.

As @DavidFoerster points out, the processors and card companies track chargeback rates.  They eye the statistics and, when a merchants is having too many chargebacks, they get cut off.  (Usually they get booted from their processor, and go find another processor who'll charge them more for the higher risk).

The same is true with stores that re-abuse cards elsewhere.  The card brands look at fraud reports and determine that these 20 fraud report cards all had Bob's Web Shack in common as a past transaction.  They will then investigate Bob's Web Shack - both because it might be a bad shop owner, and because it might be a shop that's compromised.  And - again - if a shop is a source of problems, they'll get cut off.

That's what prevents web shop owners from abusing the cards.  They'll lose any disputes, and then they'll get dropped and be unable to process cards.
