The one-time security code is triggered by a risk engine that uses several forensic profiling methods. Several risk factors are evaluated to determine if the system believes this is a normal login by you the customer or if there is potential this could be fraud. The primary risk factor is “have we seen this user with this device before.” Subtle changes to where and how you login can trigger the additional security as well as the following examples:
Clearing cookies and/or a browser setting change
Many devices used by a user in a short period of time
Multiple people using the same device
A browser update, cleared flash object, or dates out-of-sync