> I also know that Amazon can get away without enabling this since they have in-house fraud team. Their fraud team isn't that great, but that's a whole differe

> I also know that Amazon can get away without enabling this since they have in-house fraud team. Their fraud team isn't that great, but that's a whole different subject. It's not like there's a magic switch that enables 3DS. Still, 3DS isn't bulletproof. There was a time (it might still be true) where all you'd need is the card holders last name, their billing zip, and the last four of the card number, to create the 3DS password if it wasn't already created. Albeit, this wasn't the case for the larger banks, where you'd need their SSN most of the time. However, in most shops, you can search by BIN, so again, defeated... If you were carding (verb: to use someone else's credit/debit card to fraudulently conduct a transaction), depending on the dump, you'd already have this information. Of course, there's no way for the processor to check verify the name of the cardholder*, so the info on the card might be incomplete in that sense, but it's still easy to get. 3DS isn't meant to be a catch-all for fraud. Depending on how a card is acquired, the 3DS code can come with it (keylogger).