Interesting. I make a lot of online purchases with my HSBC credit card and the Visa Secure thing has never once required me to receive an SMS text.
It might be an emerging requirement. Last week I was trying to log into my Lloyd's account and grumbling about 2FA while I waited for my code to arrive via SMS, and my husband was all, "You shouldn't have to do that... I don't have to do that." I explained that I don't have to when using the app on my mobile, but I was using the website, and I've had to do it with every login lately. As he tried to log in to prove it, he was all, "Weird, I don't have to--... oh." He had to.
(He likes to act smug about these things because I'm super paranoid about online security, to the point where I don't use a lot of "convenience" apps. It was nice to hear him realize this wasn't because of my paranoia but because it's how the bank is behaving now.)