Low-value exemption
The PSD2 rule that lets small online purchases skip strong customer authentication, until the small amounts add up to a big one.
The exemption sits in Article 16 of the EU's technical standard on strong customer authentication. A remote payment of up to €30 may go through without the second factor, but only while the exempted payments since the last authentication stay below €100 in total or five in a row. After that, the customer has to authenticate again. The issuer picks which counter to keep. Contactless payments in store have their own, higher limit of €50.
The exemption is a permission, not an obligation. The merchant can request it through 3-D Secure, but the issuer can always demand authentication anyway, and only the issuer knows where the counter stands. That makes it hard to plan around: a €4 coffee can suddenly trigger the banking app because the customer has bought four other things online since last time. Larger merchants therefore lean on transaction risk analysis, which has higher thresholds.