Well, I would trust a notification of a text message than a submission of a form from a potentially phished account. Then the issue is stolen cards, and ramp-up of merchants and payers is a good way to limit risk.

I think this is a user issue. People don't currently pay with there phones. There are a bunch of options for it.