Credit card payment, the way it works today, is a broken system. So, in your case, the root problem is using a broken system. Laws around credit card fraud are

Credit card payment, the way it works today, is a broken system. So, in your case, the root problem is using a broken system. Laws around credit card fraud are the only reason why the whole system doesn't collapse. With enough power, even a broken system "works". HTTP, on the other hand, is not a broken system, it's well designed for its use case: the client has the option of sending only the information that is completely necessary for the transaction, and nothing else, but users send more data than they need and then complain about it. Remember that cookies are sent by the web client, they are not violently stolen by the server or anything. Same principle applies for everything that happens through HTTP.