2FA doesn't always ask for a PIN, depending on some fingerprinting the payment can be processed without further checks.