We COULD require merchants to implement 3-D Secure, and have issuers use a one-time password to authenticate the cardholder. But that would just make too much sense, wouldn't it?