This is a direct consequence of the global near-real-time credit card payment authorization system being the Biggest Ball of Mud design you can imagine. Clearl

This is a direct consequence of the global near-real-time credit card payment authorization system being the Biggest Ball of Mud design you can imagine. Clearly, at each and every stage of getting to where we are now, people did the bare minimum of change to add new functions to the system. The other aspect of the problem is the length of time the NSA sat on public key encryption. It's within the realm of possibility for credit card companies to have used public key encryption to at least validate that the human user of a card number knew something, a PIN or whatever, related to the card number. The payment authorization system grew up without that math, so it pretty much depends on everyone (like the call center reps or the programmers of shopping cart software) keeping the card number and the CID/CVC/CVV secret and off their disks.