It is and I would love to know when exactly that is the case. Normally all my online payments require 2FA, but some companies can apparently just transfer my money automatically. I'm guessing they need some kind of agreement with the bank, as otherwise 2FA would be pointless.