That is exactly the entire problem with credit card payments, online or elsewhere. Too often it relies on just the number, just the mag strip, possibly with other information that is _right there on the card_ (like that stupud CVC). This is totally insecure, and yet everybody keeps using it.
Dutch electronic payment (online or otherwise) always relies on "something you have" + "something you know" (which is secret and not shared with anyone ever). It's not airtight, but it's a lot safer than relying just on "something that can be stolen".
I'm still constantly appalled and amazed at US/international online payments relying on something as outdated and backwards as just a string of numbers and some other public information.