[ckorhonen]

I don't know how much stock I'd put into SecureCode etc. Recently I discovered that American Express's SafeKey could easily bypassed on BestBuy.com by leaving the browser tab open for ~15 minutes.

I assume it's up to the e-commerce site to implement the check, and in this case it had timed out and they decided to process the order anyway.

Sure, you'll probably win any chargeback, but they don't necessarily prevent the charges in the first place.

[manuelmagic]

2FA doesn't always ask for a PIN, depending on some fingerprinting the payment can be processed without further checks.