All major CC companies have the extra layer (3-D Secure) available to merchants. Whenever I make a card transaction online that is in any way unusual the bank makes me do an app/SMS 2-factor.

As with any extra step in a purchase its a balance between security and conversion rates. It seems companies have decided it reduces conversion too much in the US hence the low uptake, whereas UK/EU seem to use it very often.