Merchants can mitigate that risk by requiring use of a bank operated verification system like Verified by Visa or Mastercard SecurePay or the Amex one which escapes my memory right now. You set a password on the card via your internet banking which is required for card-not-present transactions.