Comment by Denvercoder9

> but things like this are a matter of negotiation between the card issuers and the merchants.

Not necessarily, the EU has mandated strong customer authentication by law (PSD2), and as a result has practically universal 3DSecure support.