I never use Debit Card for online or brick-and-mortar payments. I only use Credit Card for these usage scenarios. To know why, see Ketharaman Swaminathan’s answer to Which is better, using a credit card or using a debit card?.

So, I haven’t observed your situation personally.

But, assuming that Debit Card works similarly as Credit Card in this specific situation, what you’re seeing is a feature, not a bug.

PIN, where applicable, is used only for brick-and-mortar payments. Not for online payments.

For online payments, card # and CVV – i.e. security code on the back of the card – constitute one factor of authentication. In many jurisidictions, that’s enough to complete the payment. In jurisdictions where two factor authentication (2FA) is mandated for online payments, you’d need to supply one more factor, which could be either (a) your Verified by Visa (VbV) or MasterCard SecureCode (MSC) password or (b) an OTP (One Time Password) sent to your Email or Mobile Phone.