Can you even imagine the media storm in the EU or some other similarly consumer-friendly location if the evil American corporations don't compensate consumers for fraud of no fault of their own like they used to? Millions of people would mail in their cards. This is simply not going to happen.
I'm in Canada and a colleague had her wallet stolen from a locked car, PIN changed over the phone (that's a whole another subject) and purchases made. Faced with a police report confirming the story and possibility of bad press, you think the processor, the issuer, and the merchant won't budge? They budged.
See, with the current system, there's no need for "budging". Several times I've had unauthorized charges show up (both Visa and Amex). A quick call, and it's sorted out.
If you've got to invoke the possibility of bad press, that sounds absolutely worse for the consumer.
You have as many protections as your issuer decides is good business to give you. You can dispute a transaction but they can rule against your claim.
Try disputing a card present transaction in a Rite-Aid on a card with a $1000 limit and get back to us about consumer protections.
This way, they could only partially refund and say that we're lucky to get anything at all.
However, it doesn't really matter. Despite all the hue and cry, credit card fraud losses run in the single-digit basis point range as a fraction of transaction volume and around 1.2% as a fraction of issuer expenses.† Losses due to uncollectible debt (the "charge-off rate") are much higher, at around three or four percent in 2013 (but 10.9% in the second quarter of 2010).††
The pain point isn't financial. It's the bad publicity when breaches occur and the nagging fear is that losses could suddenly get out of hand due to some unanticipated vulnerability.
†http://web.archive.org/web/20091229101826/http://www.sas.com...
††http://www.federalreserve.gov/releases/chargeoff/chgallsa.ht...
And, from your own citation, on average, 10% of Americans are victims of credit card fraud and 7% of debit card fraud - this probably results in about 16% of Americans total if you assume both groups are random samples of the population.
If you've ever dealt with credit card fraud, you'd know that it's an ordeal that can be a huge pain in the ass. It can take many hours of your own time, and time from your card issuer. The cost isn't just directly financial, it's the overhead that comes as a result of the fraud.
I am certain that if given the choice, nearly everyone would take a 1.5% discount on all of their purchases if they had to do two-factor authentication on all of them in exchange.
Do you have a trusted friend or family member who is not a technologist? Ask if you can watch them a) sign up for 2FA for their bank and b) complete one end-to-end transaction using 2FA.
You may, in response to this short anthropological study, revise your estimate that nearly everyone would gladly use 2FA for every purchase.
(Additionally, merchants wouldn't be thrilled about any system which makes it difficult for their customers to spend money. If the Stripe API had a field for require_two_factor_authentication I'd set it to "false" or "are you freaking kidding me? no!" simply because I know that will cost me more in lost transactions than I lose to CC fraud.)
A secure system might use your phone as its platform. E.g., the merchant's POS presents the bill to your phone via Bluetooth. If you approve, your phone prepares a payment request, encrypts it with the bank's public key, and sends it back to the POS. The POS then forwards it to the payment processor and receives back a message accepting or declining the charge. Elapsed time: one or two seconds.
The obvious hurdle is winning acceptance for the new protocol and outfitting a zillion POS terminals all over the country and world to run it.
By the collective money of other consumers...
At one extreme, the payment industry and the merchants could end up eating the entire loss in the form of lower profits. At the other extreme, the entire loss might fall on consumers in the form of higher prices for goods and services. In reality, some of the loss will be born by producers (i.e., stock holders) and some by consumers.
The only thing that is clear is that a 7 bp fraud rate means the economy as a whole loses $7 for every $10,000 transacted.
Why doesn't Target use those payment systems? Wait, I think I know... because their customers don't use those payment systems. Are you saying that customers should "be angry at" themselves?
It has been years since I've used a credit card at a big-box store. They all still take cash.
He explicitly said the blame doesn't lie on Target.
Payments systems are a chicken and egg problem, however you would think the entity that feels the most pain from credit card fraud would try harder to replace the broken system.
This simple method works fine. The amount of fraud is not enough to make switching worth it. (And don't forget credit cards need to work even without persistent data connection.)
Credit card companies should be pissed at themselves for making it this easy.
Plus, if you think security is bad now, remember that before this we were writing checks for most transactions. At least with credit cards I can discover fraud usually the same day it occurs, and they are far more convenient that checks ever were -- as someone who has used both, I'm not all that bothered by the current state of the system.
It's basically the worst security you could possibly have for one of the highest-risk systems (direct access to money) that exist.
People need to be angry at the credit card industry for designing such an insecure system, not Target. There are plenty of online payment systems that work far, far better than credit cards that cannot, by design, ever have user account information stolen from a retailer.