There's a few things at work here.

First, the vendor should be the one verifying your ID, they're the one on the hook for it. Of course, that's usually the corporate owner, not the $5.50/hr counter help. Your own loss is capped at $50 (and that's usually waived). The bank passes through to the vendor.

Note that realtime credit card checking does work, and is pretty efficient. One profiling system I ran across suggests that the checks are run within 30-60 seconds of purchase (and since most purchases are pre-approved, that's before you're out the door). A friend once got a call on his cell phone as he walked out the parking lot. They'd just bought gas, then about $40K of toys (a few servers). This is apparently a pretty good profile -- based on AI and neural nets, BTW.

The current system is based around the principle of stop-loss. Once a card goes wiggy, it stops approving. Even a determined theif is likely to only get a few thousand dollars out of the account tops. Overall "leakage" is on the order of a few percent.

This has interesting correspondences to anti-terror security measures. If it's possible to detect and isolate individuals and groups quickly, we'll still end up with some actions, but little effective capability. A movement that has a few tens of thousands of individuals at best, and loses large numbers of these in each engagement, has little sustaining ability. The most crucial part of the equation is a world in which the police forces can work effectively -- meaning no safe-harbors. The current approach seems to be fumbling toward this ideal.