"Getting shafted" is a bit strong - it's quite understandable really. Card fraud, and particularly the statutory liability incumbent on banks/card issuers, is

"Getting shafted" is a bit strong - it's quite understandable really. Card fraud, and particularly the statutory liability incumbent on banks/card issuers, is a major thorn in institutions' sides. It's the perfect incentive to make the system more secure. If you were the CEO of a payment processor you'd do the same (or get fired.) It's exactly the same story with chip+pin: when the customer is the creator, owner, and maintainer of the ultimate authorization (fraudsters can passively steal your card number/name/expiry/CVV2, but your PIN and/or 3DSecure password is on you) and fraud occurs then it's the customer's fault for not protecting said PIN/password. Assuming the bank's security doesn't lapse (in which case they are liable, not you) then this is perfectly sensible, no? Are we seriously suggesting a bank should be liable for you not taking password security seriously enough? Or that we should stick to bullshit authorization methods like a signature purely because it takes liability away from the "little guy"? We wouldn't blame Facebook if our accounts got hacked because we kept our password on a post-it note stuck to a monitor. The logic here is the same - to imply it's any different because it's an evil bank is letting our hearts rule our heads.