My first guess is that the ubiquity of ActiveX-based payment processing software makes TLS somewhat redundant. In Korea, nobody enters their card number into a

My first guess is that the ubiquity of ActiveX-based payment processing software makes TLS somewhat redundant. In Korea, nobody enters their card number into a web page, they always enter it into an ActiveX pop-up window. So the merchants might think: Why encrypt the whole page when all the money-related info will be sent through an encrypted side channel anyway? (Of course, the ActiveX control is being delivered through an insecure channel in the first place, but try explaining that to the average CEO.) The potential liability for not encrypting usernames and passwords is probably negligible compared to the liability for not encrypting payment details. So in the absence of government regulation, there's not enough financial incentive for merchants to encrypt non-money-related stuff.