There is a cost for the communications process and data storage for the issuer and the bank.

Since there is no mining process or actual assets at risk, these fees are minimal to the point of be a fraction of a cent per transaction.

While these fees could be absorbed in other ways, by charging a fee for the transaction the risk of a malicious party overwhelming a server is reduced as there is a cost to the attacker, and the attacked party still does gain from the effort.