Online payments usually go through something like 3DSecure, where you get redirected to your bank and need to authorize the payment amount with a digipass or card reader, which require a PIN.