Guy, we've discussed this many times before..... but here we go again.....
In the UK, both major UK credit card suppliers use a system where you have to use a password when making online purchases (Verified by Visa and Mastercard Secure Code). You can choose the password, so nothing wrong with that, EXCEPT that if you forget the password, you can reset it by answering some questions, which include your mother's maiden name, and your DOB.
Since many people who apply for credit cards are worried about not getting credit, they are quite likely to supply the true answers to the questions when they apply for cards.
When someone fraudulently used my Virgin credit card a few years ago, they did it with the 'lost password' technique.
Whilst discussing the problem with Virgin customer services, they agreed that the system was poor, but they could do nothing about it because they are only agents of Mastercard, and Mastercard make the rules.
Once the criminals have established that the card is working, they can then use it again and again online, or make clone copies which they will use abroad to obtain cash from dispensers where there is no Chip and Pin.
