The second factor isn't always needed. The banks use the sort of risk factors they do for other kinds of fraud protection. If you make a larger transaction th

The second factor isn't always needed. The banks use the sort of risk factors they do for other kinds of fraud protection. If you make a larger transaction than usual, or try to make a transaction with a merchant you've not used before, then you'll usually be prompted to authenticate. There's also a limit to how many unauthenticated transactions you can make within a period of time.