3DS delegates the second factor authentication to the card emitter (your bank): the 3DS interface is really just an iframe provided by the bank. One of my bank

3DS delegates the second factor authentication to the card emitter (your bank): the 3DS interface is really just an iframe provided by the bank. One of my banks embeds their login form, which asks for a portion of your login credentials (probably secure enough in recent browsers, but still a bit yucky). My other bank requires transactions to be approved in the account management interface (either via their mobile app or by logging into their website in another tab). Other banks use one-time-password generators for their website, and reuse that system as their second factor.