The real travesty is that the credit card companies have had over 25 years to standardize a secure payment system and get it into browsers, yet have still failed to do so which is why we have fraud detection heuristics and their associated false positives. SET was launched in 1996, for crying out loud:

https://en.wikipedia.org/wiki/Secure_Electronic_Transaction