Most (if not, all) banks will send the transaction to a risk management solution such as LexisNexis including a bunch of metadata. It then assigns a risk score and your bank will factor that in with their risk appetite when deciding whether to ask for your PIN.