In canada, if i want to use my debit card online i have to log in to my online banking after i make the purchase to confirm the transaction.
I wish this sort of thing was universal.
I'm in a dodgy internet cafe with a key logger somewhere in Thailand.
I need to book a flight and the airline insists on my "Verified By Visa" credentials.
Who do you think my bank blames (even though they state that they won't) when somebody goes on a shopping spree with not only my CC # and my security code, but also my VbV password?
As another poster mentioned: It's offloading the risk to the card holder.
Something like a token, or two factor authentication would be a lot better.
My current account is with LloydsTSB and they now don't bother asking for your 3D Secure credentials and just go straight to the 'accepted' callback, because it pissed off so many of their customers.
And even if verified by visa were compulsory, it would still be possible to create a Direct Debit payment using the account details, which are frequently written on the card, and the address.