[mikeash]

Recasting fraud reduction as "1% in profits" is extremely misleading, because fraud is a tiny proportion of overall activity. Reducing fraud by 1% of profits would require a huge improvement in your ability to fight fraud, whereas reducing legitimate transactions by 1% of profits is much easier.

And it's not like card companies do absolutely nothing. The US is finally moving to chips, which will cut down a lot. Notably it's just chips, not chip-and-PIN, because they want to keep that friction low. But when they are able to fight fraud while still keeping friction low, they do it.

I think the market is competitive enough that if people wanted more security, someone would offer it and it would gain in popularity. We do see this to an extent, with security features like sending transactions to your phone as they happen. In fact, a very few banks will issue you a chip-and-PIN card right now if you want it. Or you can get a debit-only card, with no credit features, so that a PIN is always required. Mostly people don't seem to care, though.