It’d be great if they could trigger 3D-Secure without a purchase, but that would probably be a whole mess to work out.

Edit: looks like it might be in the spec from some very brief research, or at least “coming soon”: https://3dsecure2.com/non-payment-authentication/