Been working in e-commerce fraud for ten years...
The credit card security model is broken as designed with the exception of chip and pin and chip and signature.
Uptake for 3D Secure is uneven around the globe. Some places it is mandatory and others unheard of. For example not using it will negatively impact close rates in India but using it in the U.S. will negatively impact close rates.
With 3D Secure each issuing bank was responsible for how they implemented the process and it varies widely in both ease of use and security between issuing banks. Some banks may use simple passwords that can be fished while others may use one time pins sent by SMS to your mobile.
When a merchant uses 3D Secure fraud liability shifts to the issuing bank and the merchant gets a discount on the interchange. This is also true when the bank hasn't implemented 3D Secure or has done so poorly. Because of this when 3D Secure was launched some banks put out systems that were non-functional simply to avoid the liability shift (i.e. it would prompt for a password but there was no functionality to create one). Issuing banks have gotten their act together in the last decade but it's still uneven.
Even when a merchant implement 3D Secure the merchant still needs to manage fraud levels to card association rules even though the merchant does not have liability for the fraud. This is the "we have to assume the risk but we don't have to do business with you clause." Individual issuing banks may chose to decline all of a merchants transactions if loss rates are unacceptable and the merchant may still lose their merchant account if overall loss rates are too high. However because the charge back shifts to the banks the merchant may not even know which transactions are fraudulent.
Recently rules have been changed so that banks aren't required to prompt for authentication in all cases. This is called risk-based-3D secure. So even if Candy Japan had implemented it he still may have seen the attack because the banks may not prompt for that low of an amount. He wouldn't be out the money but still may be in trouble with the association if he didn't do something to stop the attack.
When looking at automation there are two fundamental risk that any solution needs to address. The first one is class separation which in the industry is known as scoring or out-sorting. In this area machine learning algorithms are well understood and there are a few companies on the market that will rent merchants a model such as Sift Science or MaxMind.
The second one is anomaly detection and in the industry this is know as velocity control. The problem is similar to detecting a hacker once they have penetrated the network, detecting a bio-terror attack based on hospitalization data or detecting insiders who have flipped. These types of things have generated a lot of military interest and a lot of DARPA funding but little of it has made it into the commercial market due to the high rate of false positives.
Card testing is one example of a 'high velocity' attack and are usually the work of professionals. High velocity fraud has been more common with digital goods but more recently we've seen more high velocity attacks where an attacker will upload a merchants products on a site like Amazon or eBay. When the attacker gets a sales they will use stolen credit cards to get the trageted merchant to fulfill the order. Since these are professionals they generally will have tested the merchants fraud systems to understand what is considered low risk by the merchants fraud models and unless the merchant has some monitoring losses can be very high by the time the charge backs start coming in.
Currently there is no automated, fool-proof method for managing these high velocity attacks that I'm aware of. Merchants initially started putting limits around the number of times that a single card could be used and the attackers responded with SQL injection attacks to get card in mass. Merchants responded with limits on email addresses or other data points and the attackers responded by mass registering emails on free email providers and registering their own domains. Merchants responded with limits on IP addresses and used of geo-ip location services and attackers responded with open proxies and VPNs. Merchants responded with limits on orders from co-location facilities and VPN providers and attackers responded by compromising end-user machines en-masse. Merchants responded with proxy detection and device fingerprinting and attackers responded with using RDP to end-user machines to launch attacks. And it continues.