In my country we confirm every transaction with 2FA, if the site supports secure payments (almost every website)

Sigh. I wish the US would encourage this. It would make me feel so much more confident about fraud prevention.

EU caps card interchange fees (.3% credit .2% debit), so the baseline is lower. US has comparably huge card rewards, those have to come from somewhere, so with 1.5-3% interchange fees the incentive to implement 2FA to cut, say, 0.2% off commission is just not there..

Why would Visa/MC/Discover/AmEx or the banks issuing credit card accounts have to lower commissions? They can implement 2FA to reduce their fraud costs, but they can pocket the difference unless they feel competitive pressure. But if there exists enough savings from 2FA by preventing fraud such that they can offer more rewards to credit card users, then it would be a competitive advantage.

The US doesn't even do chip+PIN, just chip. I have to assume the US is fine with a higher baseline level of fraud than the EU. I don't know how the economics make that work.

And online, the validation/authorization isn't any better - as long as somebody has the card number and my zip code, they can do as they please (until/unless some banking anti-fraud algo picks it up).

It’s crazy to me too. A few years ago, all the card networks told merchants that any in person merchant who does not use chip transactions will automatically lose chargebacks, so whatever in person merchants have not converted to chip are simply not willing to invest in updating their systems.

They've pretty much all moved to chip at this point, at least IME. It's the lack of PIN that confuses me. All the terminals have pin pads already, but whether they request the PIN is pretty spotty (seems to be bank card vs true credit card?).

Not OP, but every time I do a purchase online with a new shop, my bank does this. Also every time I spend more than x euros in one transaction.

Before that they sent an SMS code, I much prefer the app notification.