Requires authentication for the initial purchase, but fails for subsequent payments (including off-session ones) with an insufficient