Look at the payment card industry: the whole system is fundamentally broken by design and has zero meaningful privacy and security since its inception, yet it somehow survives, decade by decade, with more and more layers of bureaucratic band-aid.
Look at the payment card industry: the whole system is fundamentally broken by design and has zero meaningful privacy and security since its inception, yet it somehow survives, decade by decade, with more and more layers of bureaucratic band-aid.
Quite the contrary: The parts of it that are broken are broken due to industry inertia and backwards compatibility considerations.
Payment cards have had the capability for strong cardholder authentication both online (3DS) and at the POS (chip/EMV and PIN) for almost two decades now.
There just isn't political/regulatory will to enforce their use in the US, and nobody will move first without being forced (since it's game-theoretical/economic suicide to be the first mover). In the EU, both are now largely mandatory.
Although I went ahead and got a PIN for my US credit card after I had an issue, I don't know the last time I've had to use it in Europe. I do sometimes scrawl a not really signature now and then.
In other words, it's effectively impossible to get a PIN-preferring, i.e. more secure, credit card in the US...
My comment was that I have been asked to enter a PIN in Europe which is why I requested one. But I've never used it since.
You're covered for fraud by the credit card bank so, as a consumer, I don't really care about the level of security.