Both my Danish and British accounts send an SMS for some purchases, usually only larger ones. I have to type it into a box on a form.

They used to use a password, but that risks people putting their bank password into some dodgy shopping site.

VISA's implementation: https://www.visaeurope.com/making-payments/verified-by-visa/