They don’t have the other factor. That’s the whole point. 2 sources of identity confirmation, hacking one isn’t enough.
Online financial transactions are really no more risky than any other. Once money became a paper trail somebody has always been in a position to steal it while nobody is looking.
Surprised I’ve never had many issues with credit card fraud considering I’ve used it at restaurants for years but somehow feel uneasy giving the waitress our waiter my cc and they disappear with it. With the prevalence of cell phone cameras, what’s stopping them from taking pics of the card including the security code and then just making purchases on Amazon with it?