I've been thinking about this and there might be ways to do it without regulations. The "big gun" without regulation would be if the likes of Apple and Google

I've been thinking about this and there might be ways to do it without regulations. The "big gun" without regulation would be if the likes of Apple and Google (and/or Visa / MasterCard) telling the card issuers that they have to use these security standards. But in my "ideal world" I don't like giving Visa/MC even more "power", however in this case at least it would be kicking the card issuers and not the consumer (same could be said for Apple/Google) The other way would be to hit the US card issuers in their pocket via class action that they were not using these security practices which could have protected customers from fraud. But yeah you are right, until external forces (be it the card networks, digital wallets, lawsuits, the feds, etc) make entities do the "right thing" they will often just do the bare minimum.