An important point to note is that, if banks want/care, they can put other safeguards that solve this problem, too. In Europe it is common for banks to text you a 6 number pin to confirm an online transaction, for example. There is no good reason to not do these things. It's still not perfect, but certainly much better.