The second factor isn't always needed.

The banks use the sort of risk factors they do for other kinds of fraud protection.

If you make a larger transaction than usual, or try to make a transaction with a merchant you've not used before, then you'll usually be prompted to authenticate.

There's also a limit to how many unauthenticated transactions you can make within a period of time.