I do not know anyone using a credit card without first enabling two-factors-authentication. My bank considers it mandatory, they will not enable my credit card if you do not first enforce two-factors-authentication on it. Perhaps your bank is not so strict, but still it is your fault not having enforced this fundamental safety measure on your credit card.
My cellco charges me something (however little) for every text message so if my bank made that mandatory, I'd find another bank.
In the US you dispute the transaction and I've never had one not refunded. Credit card companies lose billions/year to fraud, most of it "card not present" (U.S. payment card fraud losses by type | Statista) -- imagine what the profits must be if they take 3bn/yr loss in their stride.