Anyone have any idea whether this could have been prevented if banks in the US required PIN to process a transaction? Would fraudulent transactions go down significantly if stolen cards couldn't be used without PINs?
It might help (depending on just how hard they make it to reset your PIN over the phone) but it probably wouldn't happen. Credit card companies make money when you use your card. As such, they want you to use your card as much as possible. Anything which increases the friction of a card transaction reduces how much people use their cards, and thus directly impacts their bottom line.
Not requiring a PIN is an example of this. If your customers have to memorize and enter a PIN, this added friction will cause at least some of them to pay cash (or whatever other payment method) instead. That's lost revenue.
Similarly, it shocks many people to learn that credit card merchant agreements forbid requiring customers to show ID as part of the transaction. Seems like a sensible way to fight fraud, right? But it also adds friction, which reduces credit card use rates, which hurts card company profits, so they don't let you do that.
This stuff is all a careful tradeoff. They know how much they lose to fraud, and how much they gain in legitimate transactions from making things easier. The goal is not zero fraud, but rather whatever level of fraud is optimal for their profits, which is almost certainly not zero.
