> The comment originally was in the context of "I'm not truly sure what the right fix is." ; technically, a pretty decent fix is implemented elsewhere so it's not that hard to find. 3DSecure is implemented widely in Europe due to PSD2 regulation, you just need one like that in US, doesn't even need to be very original, they can copy most of it from EU. I'm not saying there aren't social/political challenges, just that there needs to be a will - because there already is a way.

Yeah, I’m saying that the people who could make that happen don’t have the incentives to do it, so the right technical fix is politically, commercially, or financially infeasible for many of the people who would have to agree in this. Solving that problem doesn’t have an obvious right fix.

Why is it so different in the US? Simply put, credit cards were widely adopted before 3-D Secure (or even chips) existed, to such an extent that they’re even now far more dominant than they are in Europe, and the number of issuers and merchants is far greater and more evenly distributed across small businesses (yes even many of the issuers).

So any modernization of the US credit card infrastructure is hard and slow. You’d be surprised. Even having a chip in US cards only became widespread recently, but they still don’t usually have a PIN used when making a in-person purchase. (The cards still work in most but not all European payment terminals - the machine often requests a signature, though the staff only sometimes bother with it.) Canada does at least have chip and PIN as standard.

> Well strong customer authentication is only relevant for online purchases

If you’re talking about the EU legal requirement, yeah - although it actually doesn’t apply in full if the cardholder’s bank is outside the EEA, the UK, or one other nearby country, even if the transaction is in the EEA. (Weirdly, Switzerland is also out of scope, despite how integral it is to Central Europe, probably because it’s not in the EEA.)

But in the US, plenty of in-person fraud still happens too with cloned or stolen cards. Adding a chip has made this somewhat harder but not as much as you’d like, especially not without a PIN.

> I'm willing to bet that the number of non-EU clients purchasing _online_, via _insecure cards only_ is negligible (one can offer other alternative ways of payment).

All of this very much depends on the business. For a business like OP’s which sells event tickets, if those event tickets have an international clientele such as tourists traveling from outside Europe or one of the few other countries where these technologies are commonly supported, there may not be any good other way to make the online ticket purchase happen.

Yes, credit (or effectively equivalent debit) cards without common 3-D Secure are that dominant in the US and Canada, although some people use PayPal or other local solutions too. In fact, credit and debit cards are the only way to buy online that’s routinely offered by most merchants in the US, so there’s no way to exclude non-European credit cards without excluding many US customers.

And lots of US or Canadian tourists in Europe really want to use the credit cards, because the fancy cards that frequent tourists or foreign-resident Americans/Canadians use often zero out the foreign currency cost with no foreign transaction fees, and/or because of reward points offered by the cards that are better for the cardholders (at more cost to the merchants) than what’s offered by issuers in Europe.

Traditional bank transfers (wire transfers) to Europe from outside the SEPA region are complicated, often slow, and expensive for both sides.

Plus keep in mind, the US and Canada are not the only countries where banks don’t have to offer strong customer authentication. It’s only required in the EEA and a few other countries. So when I said “international clientele” I don’t only mean North Americans.

> Also I _think_ that if merchant requires 3DSecure but bank doesn't offer it, the liability passes to the bank (i.e. BoA may decide to authorize the transaction on the card without 3DSecure - but in case of fraud, they will be the ones eating the loss, not the merchant). Not entirely sure on this one, though :)

If this does apply to US-issued cards, that might be why the two US-issued cards which I routinely use in Europe have finally added the frictionless flow version of 3-D Secure. However they don’t support the kinds that actually involve the customer in a live authentication, just some fully automated checks.