Ah that makes sense. I respect you not wanting to use an app, but most likely >90% of the people who make online purchases also have their bank's app so it makes sense that the flow is optimized for that.

I use Wise too, but they also support 3D secure and it is generally required on European merchants... Works great in the app, but it's probably clunky without it too :/

So there are a couple of issues at play here. First, a merchant can charge your account with only your card number, date and CVV. If you call up and pay someone, say an insurance company, that’s all they need. Now your bank might automatically reject that charge if it seems suspicious, but that’s their call. This is why fraud is/was so rife in the US, because anyone who imprints your card can pay with it. Adding a chip and 3D secure mitigates that somewhat. If someone steals your card, usually it’s just an inconvenience because the bank will freeze your card, issue a new one and refund fraudulent transactions.

Typically the reason you see 3D secure is for chargeback protection. Chargebacks from fraudulent cards are both common and expensive for retailers and they want to minimise it - so they check your address etc. Ever notice that the checks sometimes make no difference? For example sometimes the billing address gets checked and fails if you put in the wrong one, other times it doesn’t seem to matter. I believe this is a merchant decision (some places just use it to generate invoices for tax purposes).

I don’t know of any regulation for using apps, but 2FA may be required? With Wise I can respond either via SMS or the app. I also have another fintech card which gives the option of sending the OTP over email which is useful when the app isn’t available. Also as an expat I have two phones with different sims, so I need solutions that aren’t device locked (at least one bank only allows me to have one mobile device registered).

> I don't have any Android or iOS device on which I can install your app, and I would not do that anyway.

I don't think you can really complain that they aren't using convenient 2FA because you don't have a smartphone. It's a pretty reasonable thing to require these days.

You didn't complain that the online shop itself required the use of a computer.