It's mandatory by law, and it's additionally to the 3 numbers at the back of the card. Usually it works by confirming or denying the transaction on the App of your Issuing bank