Whether to verify the identity of the buyer using 3D-Secure or not is up to the online seller, not the bank that issued the card. Some companies deliberately conduct some operations without this technology in order to simplify purchases for customers. Online store AliExpress deliberately abandoned 3D-Secure. The first few operations there will be confirmed with a one-time code. When the store is convinced that the account is not fraudulent, you will be allowed to make transactions without 3D-Secure, so that the buyer does not make unnecessary movements and does not change his mind after he receives an SMS with a password to confirm the operation. Thus, AliExpress independently decides when to use 3D-Secure, and when not. AliExpress is just an example of how you can pay for purchases without 3D-Secure, and not a place where they really steal. They practically don’t steal money through it.