I don't understand what's the deal with stolen card numbers. Doesn't new bank accounts require 3D Secure to enable online transactions? That's how it works in my country. I could paste my card number right here and no one would be able to spend a dime with it unless it goes through 3D Secure.
It’s a mechanism that is compulsory in EU (and nearby countries like Switzerland).
When you try to spend money online (without the plastic card), you need a second factor. In practice in, let’s say, Amazon there is an iframe with a page of your bank that asks to confirm the operation on the banking app or insert the code they sent you by SMS or things like that
Every country has a different way of securing cards, and north america sucks at it.
Depending on the payment processor, here in Canada you need my card number, as well as one or two of the following: PIN, Postal Code, CVV/CVC, a voice changer and my mother's maiden name, etc to do a transaction without my physical card.
With my physical card you don't even need that for $2-300 purchases (depending on retailer), or more if the retailer hasn't blocked swiping/the thief has access to a swiping card reader.
Required: only in EU
Available: EU close countries (UK, Switzerland, etc)
In the US banking is a bit different than over here. People still pay rent with checks (that in EU are de facto obsolete) possibly sent in an envelope via mail.
You may wonder why…. Because a money transfer (that in EU is generally for free) in US is often a double digit operation.