3DSecure is ... weird. It doesn't always trigger. It depends on some measure of "risk" (however the hell that's determined). E.g. my payments to pizza place never invoke 3D Secure because I order from them so damned often.

I would be happier if this were configurable by the user, because I too would be happier if all my online payments required my second factor.