I really think 3D secure is a good move. All it requires is entering your internet banking password at the time of making the transaction. Is this really so bad for usability?
the system has no safeguards for vulnerabilities like man-in-the-middle,etc. attacks. Yet it gives credit card companies, the right to deny chargebacks to customers (whose credit card was stolen/hacked) because they can now wash their hands off the matter ("hey only the customer knew the second password... he must have been careless with it, not us")
Seems pretty valid argument to me.
This is not a hypothetical situation - this already happens in Western Europe! It's hard to hold banks or merchants responsible for fraud. Now they shouldn't always be held responsible, that's the first issue; but even in cases where they are (like when they guaranteed upfront that they'd take the risk of fraud, as they used to do in the early days of online banking/payment) their first line of defense will be vague 'our technology is tamper proof' arguments. Many consumer association websites are full of stories about this.
I was able to reset it on the spot by providing my birthday and some information from the card (CVV and expiry date iirc). So really the only additional information someone needs to use my card now is my birthday (and that's without even going to the trouble of MITM).
Perhaps it's a good idea in principle, much like OpendID, but in the real world it's a pain to use for everyone involved.