The key is that it's somebody else's problem, not yours.

Sure. As a merchant myself, though, I cringe at generalizations that the bank eats the cost.

Personally, I think they should, because they have access to the aggregate data that could prevent more of it.

Because they take no hit for online fraud, however, they do almost nothing to make things better.

Well, they implemented 3D Secure. I've had to use it quite a few times for online purchases this year (I use an European CC, if that makes a difference).

Although apparently it's a crappy protocol and it's used to shift liability to customers[1], so yeah, they could do better.

[1] http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf

Verified by visa (and similar) in the US just never took off. You have to implement it as optional, as most consumers have no idea what it is. So very, very, few people use it if you turn it on.

I dont think that's true with vBv and Securecode - I believe that indemnifies the merchant of stolen scenario if enabled, at least in Europe.