.
The customer would only be required to pass an authentication challenge if their transaction is determined to be of a high risk.
Since the merchant does not know this password and is not responsible for capturing it, it can be used by the card issuer as evidence that the purchaser is indeed their cardholder.
The problem for the cardholder is determining if the pop-up window or frame is really from their card issuer when it could be from a fraudulent website attempting to harvest the cardholder's details.