It's only mandatory for selected regions, like Europe (PSD2 SCA), but even there the merchant can ask for exemption based on the amount, level of risk and recur

It's only mandatory for selected regions, like Europe (PSD2 SCA), but even there the merchant can ask for exemption based on the amount, level of risk and recurrence. Transactions under 30 EUR are exempt by default, unless the customer have initiated 5 transactions, or 100 EUR worth of transactions since they were last authenticated. For recurring fixed payments only the first one has to be authenticated.