Specifically, in the EU new Payment Services Directive 2 requires two-factor authentication on online payments. Banks and issuers do not bulge, as merchants pay most of the fraud cost, so government and regulators need to intervene.

Funnily enough PayPal and Stripe were lobbying against this "harming of consumer experience."