In the EU I couldn't get a chargeback even when the company said they mistakenly charged me twice, and that I should do a chargeback.
I know that theoretically the law is on my side, but practically I found it to be a huge hassle in the EU.
And of course, SMS 2FA is not secure at all. Now if there's fraud and the scammer used 3dsecure with spoofed SMS, good luck convinging the bank it wasn't you.
"But SMS is not the only option" you say, "other banks have better 2FA", actually, I use other banks too. And they have something insane for 2FA: https://lobste.rs/s/1cyltz/two_factor_authentication_now_ava....
And yes, agreed, SMS stinks. I have tokens for everything and insist on that. Unfortunately some banks now only have sms...
And chargeback was always impossible in my case. In the US I click a button in the webui, or call a phone number. In the EU, I had to come in person to the bank three times, and fill all kinds of forms, and in the end, I still didn't get my money back.