> unless it can prove that the transaction was legitimate.
And what is the standard of evidence for that?
> So basically, they can't put liability on the customer unless 2FA is used. The second factor is usually the credit card PIN.
That doesn't sound like a second factor? Or are you talking about POS transactions?
> Banks have to maintain a balance between convenience and risk of fraud.
Really, they don't. The bank should never decide to take on risks for me. There is nothing wrong with offering a feature where the customer can select to allow certain transactions without 2FA. There is everything wrong with forcing that feature on customers.
