Tesco "have contacted 3DS customers to apologise and offer refund", apparently. So that's what the invoice in my inbox is for.