Braintree javascript Drop-in 3d Secure 2 returning 2099

3d secure checks seem to sometimes return a 2099 - which suggests i'm not doing a client-side check. Can someone let me know what i'm missing?

form.addEventListener('submit', function (event) {
              event.preventDefault();
              dropinInstance.requestPaymentMethod({threeDSecure: threeDSecureParameters}, function (err, payload) {
                if (err) {
                  console.log('error in request payment - ', err);
                  return;
                }
                if (payload.type !== 'CreditCard') {
                  nonceInput.value = payload.nonce;
                form.submit();
                } else {
                let liabilityShifted = payload.liabilityShifted
                if (liabilityShifted !== true){
                  dropinInstance.clearSelectedPaymentMethod();
                  console.log('card payment was unsuccessful')
                  alert('Payment unsuccessful, please use another card, or alternately use PayPal');   
                } else {
                nonceInput.value = payload.nonce;
                form.submit();
                }
                }
              });
            });

the response comes back with this snippet:

{
  "nonce": "c47ba6c8-2b01-05f0-22e1-cec40f25c734",
  "details": {
    "cardholderName": null,
    "expirationMonth": "10",
    "expirationYear": "2023",
    "bin": "xxxxxx",
    "cardType": "Visa",
    "lastFour": "xxx",
    "lastTwo": "xx"
  },
  "type": "CreditCard",
  "description": "ending in 67",
  "liabilityShifted": true,
  "liabilityShiftPossible": true,
  "threeDSecureInfo": {
    "liabilityShifted": true,
    "liabilityShiftPossible": true,
    "status": "authenticate_successful",
    "enrolled": "Y",

which suggests authorisation was approved (the customer sees a zero € transaction - but when i then try and create a subscription it rejects it with:

processorResponseCode: '2099', processorResponseText: 'Authentication Required',

what have i missed?