Been living in a couple of European countries in last few years, luckily I never fell prey to any fraudulent operations (I pay online sparingly, mostly for air tickets; paying by card and using ATMs quite often).
There are multiple ways to minimize the risks in very simple ways, and it's strange the banks/card companies do not care about it.
1. Have separate cards for ATM+payments and separate for just online transactions. As simple as that. In Poland many banks offer "virtual cards" i.e. just CC number + CVV for internet-only transactions. But it's usually extra paid (though rather cheap).
2. Suppose 1. is impossible, then why on earth CVV is printed on the back of the CC?
3. Being a geek, I'd love to have a superuser panel in my online banking interface where there would be on/off switches like: enable this card for particular regions/countries, enable for internet transactions, etc etc. I'd turn them on if I plan to go to Indonesia or Colombia; for 90% of people random transaction in a remote country is a fraud.
4. In one of my banks I can't change PIN to my debit card in the ATM. WTF? Well maybe it's a security feature, otherwise people will put 1111 and be happy [1]
5. In one of my online banks, my login is publicly known (part of account number) and password is max 6 digits (0-9) <sigh>
IMO the best always-available precautions are to
1) keep just a bare minimum on the primary account and put the rest on a savings account, which can't be accessed via card outside the issuer bank's ATMs,
2) monitor transactions via online bank at least weekly.
Deutsche Bank online banking allows authorizing bank card use in foreign countries. The feature is only available on the German version of their website. I can also set daily / weekly limits for my bank card. For online transactions, I think 2 factor authorization is used. (e.g. enter a TAN)
For my bank account in US, I am not aware of any option for authorizing foreign transactions online (only calling the bank), nor setting usage limits. I can set alerts to be notified for transactions, but only $100+ transactions.
The one time I did get "hacked", it was with another card where I got notified immediately by email each time it was used. So found out quickly when thousands of dollars were being spent on iTunes! I think those were in a rapid series of smaller transactions (can't remember, less than $100 or more, but maybe less). The notifications allowed me to promptly get my card cancelled to at least limit the damage and then was able to get my money back. Lesson is for stuff like iTunes (well, I don't like to use them anymore), but generally to buy gift cards, when possible, for online shopping/services and put the credit onto my account. For more popular places like Amazon or iTunes, gift cards can be bought in many brick and mortar places with cash. Then I don't have to give them my credit card or bank info.
The issue with transaction limits (while they're good in general) is exactly what you've mentioned, lots of small transactions quickly after each other do not get blocked.
Actually this is now one of the most popular card frauds in Poland right now: majority of newly issues cards are paypass/paywave-enabled and moreover, offline (not checking the balance while paying, and usually there's also no limit imposed on number of consecutive operations without PIN - though technically it would be trivial to implement).
I.e. you can even make someone a negative balance on his account with a series of rapid small (<12€) touch transactions, and many people are not aware of this, while banks keep telling people that everything's super secured.
well, I can set a limit of say 500 euros (or whatever I need) per day. So even with a lot of smaller transactions, there is a point where they would stop.
Damage can still be done, though and I'm not aware if/how I can get alerts for transactions. So I need to remember to check my account often.
In Portugal there is a centralized system that allows people with cards from almost any bank in the country to generate virtual credit cards with any limit you desire for free.
There are multiple ways to minimize the risks in very simple ways, and it's strange the banks/card companies do not care about it.
1. Have separate cards for ATM+payments and separate for just online transactions. As simple as that. In Poland many banks offer "virtual cards" i.e. just CC number + CVV for internet-only transactions. But it's usually extra paid (though rather cheap).
2. Suppose 1. is impossible, then why on earth CVV is printed on the back of the CC?
3. Being a geek, I'd love to have a superuser panel in my online banking interface where there would be on/off switches like: enable this card for particular regions/countries, enable for internet transactions, etc etc. I'd turn them on if I plan to go to Indonesia or Colombia; for 90% of people random transaction in a remote country is a fraud.
4. In one of my banks I can't change PIN to my debit card in the ATM. WTF? Well maybe it's a security feature, otherwise people will put 1111 and be happy [1]
5. In one of my online banks, my login is publicly known (part of account number) and password is max 6 digits (0-9) <sigh>
IMO the best always-available precautions are to
1) keep just a bare minimum on the primary account and put the rest on a savings account, which can't be accessed via card outside the issuer bank's ATMs,
2) monitor transactions via online bank at least weekly.
[1] http://www.datagenetics.com/blog/september32012/index.html