Every time I've reserved a hotel room with Booking.com, the payment has required 3-D Secure verification. For me, this involves entering my VISA card's PIN into a card reader, thus needing both physical access to my card and knowledge of my PIN. That might not be very much consolation, but it's at least some protection against having your account fraudulently drained.