Credit card processors and banks could do a lot to combat fraud that they don't do. Eg, realtime 2FA per transaction, which, as a bonus, could give the user a c

Credit card processors and banks could do a lot to combat fraud that they don't do. Eg, realtime 2FA per transaction, which, as a bonus, could give the user a chance to categorize the purchase in their budget. They do exactly the amount of security that they think is most profitable - balancing losses to fraud vs abandoned sales because of inconvenience. Jumping straight to face recognition is a bit like physical security adding strip searches when they haven't yet bothered visually scanning for weapons.