Putting in security steps costs banks money to implement and puts in a burden that may reduce use – so banks often do less than you would hope they would to be careful (less than I imagine intelligent people would guess that they do).

The banks and credit card companies do spend huge amounts on anti-fraud measures. It is just they are still not doing nearly as well as they should, and some things are really lame (like the ancient card technology until very recently in the USA – we were far behind the rest of the world in card security measures). And reading about some of their actions on Apple Pay also show some amazing lapses in thinking of security.