If U.S. credit-card issuers were worried about fraud, they would have implemented the other half of "chip-&-PIN," which the rest of the world has been using for decades.
U.S. customers pretty much JUST got chips in our cards... but issuers "forgot" to implement the PIN part.
Zero sympathy for this scumbag monopoly.
In my country you usually need to confirm payments with SMS OTP, except for trusted merchants (but they take the risk of fraud by opting out from confirmation). So simply stealing a bank card doesn't get you far. And pretending that you did not pay is also more difficult. Is US different? Do banks and clients trust each other in US and do not require OTP?