> I wish there was a fundamentally different way of handling payments

Seconded. At the risk of simply rephrasing everything you just said:

It's a pity the banks and credit card companies just refuse to innovate.

When I buy something from an online vendor, they should never get my full card details. PayPal ameliorates things (you can generally trust PayPal), but really there should be no need for PayPal. The banks/credit-card companies should provide a convenient way to authorise the payment, in a way that doesn't trust the vendor.

Here in the UK, we already have chip-and-pin, and card readers (the kind that show unique numbers - they're used for online banking), but we're still stuck with the trust-the-vendor-or-use-PayPal model for online payments.

Using card-readers for online payments would also help with credit-card theft.