What about Verified by Visa? It seems pretty commonly used for online purchases outside the US and having it may make purchasing train tickets, etc. easier. It doesn't seem like it'd be difficult to auto-enroll everyone and just have it send a one time code (for every purchase requiring it) via SMS or email--much like their website does when you log in from an unknown device.