More importantly, most companies have to prevent cracking, as opposed to hacking. When an insider breaks into a system, it's called cracking, which happens in 90 per cent of system break-in cases. But companies maintain a stony silence for obvious reasons. And you can't possibly keep on changing your credit card or remember a string of passwords. So, most companies are investing a lot of time, effort and money to devise the perfect, secure system.
Some companies even prefer to do the validation off-line.
That is through a phone call or some means like that. But that defeats the very purpose of electronic commerce. Obviously, the communication has to be private. When you encrypt a message, it is like a scrambled telephone message. Anyone who breaks into it will come across a jumble of meaningless words, and hacking the code is simply too tiresome to be worth it.