It's mandatory by law, and it's additionally to the 3 numbers at the back of the card.
Usually it works by confirming or denying the transaction on the App of your Issuing bank
The text on that link of yours is sneaky though:
"...you MAY be asked to..." (Emphasis mine)