AmEx now leads the pack in resisting card not present fraud. However, merchant and consumer adoption will determine how effective the measures are going to be. Merchants should not be accepting credit cards without one-time passwords.
If on-line merchants accept proxies and one-time passwords at the same rate that brick and mortar merchants have accepted EMV, then "card not present" fraud may be lower than card present fraud, at least until the brands and issuers remove the password in the clear on the magnetic stripe.
In any case, we now have available the biggest advances in payment security since the introduction of on-line transactions at the point of sale.
How about that the PCI Council provide the same penalties for failing to use these new on-line tools that they provide for failing to use EMV?