Card fraud was a huge problem in Europe/Russia/Asia etc, but less so in the US (probably related to US's dependency on credit and "credit history"). The internet was taking off and magnified this problem exponentially. To counter this the card companies decided they needed more security in all/most markets outside of the US.

In the "Amazon" type of model, Amazon collects card details and more or less keeps it on file. When a customer wants to buy something, the card companies and Amazon's bank more or less trust that Amazon will keep fraud to a minimum by looking at usage patterns, doing proper card authorizations etc.

They allowed this in the US, but decided to forbid this model more or less everywhere else. Everybody else had to start using 3DSecure.

With 3DSecure the purchaser's bank gets a say in each and every transaction. So you've now got Amazon, Amazon's bank, the customers AND the customer's bank. So when a purchase gets done, the card companies now demands that the customers bank (who know their customers) guarantees that it is the actual customer who is at the other end. The customer's bank can decide not to do any checks, but then if there IS fraud, that's the customer's bank's problem.

So most customer's bank require that the customer - at the time of purchase - identifies himself. Very often this is done by throwing the customer back to the customer's web-based banking solution (which already has identification procedures in place), or something similar, where the customer's bank can authenticate the customer (with passwords/2-factor etc).

The technical details of how 3DSecure actually works sucks bigtime. At least when it was launched it involved using encryption and signing xml-based documents. To make this work those documents had to be "normalized" etc - a huge mess.

Because of the mess, there probably is very little competition in implementing solutions for 3DSecure. Which again is probably why most 3DSecure feels like a throwback into the "Web 1.0" area, with the customer being thrown back and forth between the store and his own bank, typically with a user interface reminiscent of the "CGI" area.

Another consequence is that the US have had a huge advantage (and probably still do) when it comes to everything related to internet e-commerce, simply because the card companies and banks do not allow deviations from 3DSecure anywhere (mostly) but the US.