Indeed, we need a ticket system for custom tokens per merchant. So instead of actually putting in the credit card number, you put in a token (very similar to an oauth type token).

If say for instance the token you gave to Adobe gets stolen, you or they just disable all tokens or ask for new tokens.

So not only will fraud be more difficult but merchants also will be known who has been compromised. Right now banks won't always tell you what merchant was compromised and causing you to get a new number/card.

New payment systems have this, for instance stripe is built similar to this.

Why do people have to update all their cards with all their merchants after one fails? Getting multiple cards and internet cards sometimes helps compartmentalize but really we need this at least per merchant.

Some banks have this like Bank of America ShopSafe but it should be the new normal.