Or they could just require 3d secure which iirc lets them say "you did 2fa when you purchased, we know this wasn't a fraudulent transaction, fuck off."