The trick with credit cards is to remember the credit part of the system. You're not actually paying at the point of sale, you're creating two credit relationships where you owe the issuer money and they owe it to the merchant. Effectively two 'IOU' pieces of paper, and about as secure.
The next thing is that you don't necessarily have to pay if they can't establish that it was actually you that did the transaction. If you successfully repudiate it, the merchant doesn't get paid for the transaction. If a merchant gets defrauded too often, they can be banned from the system.
So, various forms of payment system come with different proofs to the merchant about the card. In cardholder-present transactions you have the opportunity to look at the card and the customer when making the decision. It's harder to automate the fraud or carry it out from a safe distance. So these can be done with just card+expiry. Everything on the front of the card can be copied with one of those card imprint machines that use carbon paper and submitted by the merchant by post. The pre-internet system.
Cardholder-NOT-present transactions are the opposite. Fraud is easy to automate. So most online transactions ask for at least the CVV (three digits on the back of the card, not copied by imprint and not on the magnetic track). Most online retailers insist on an address which must match the cardholder address before posting out goods. People selling "cashlike" things (gift cards, game time cards) sometimes do phone verification too because they're very high fraud targets.
The hotel reservation case is funny because there's almost no fraud case possible. There's no point in making a reservation with a stolen card and then not showing up, it gets you nothing. If you do show up, it turns into cardholder-present, and many hotels take a copy of your ID.