Okay but like... so what? Like does that even really pass the common-sense test that that is enough?

Like my bank would give me a phone call before I wired $20k oversees. Google should by default send you a sms confirmation on your first $10k+ purchase. This is the type of common-sense stuff that isn't an issue in-person, but somehow online we get the most barebones protections for consumers because "technically the EULA said so and so."

Basically if we make the corporations liable for it, we give them an incentive to prevent fraud, identity mistakes, etc. Whereas if they are not, we give them every incentive to avoid unintended purchases.