Confirming online debit and credit card payments with a one-time password has become a standard practice in the EU. These solutions are also available in the US, are they not being adopted by banks there?
https://usa.visa.com/pay-with-visa/featured-technologies/ver...
https://www.mastercard.us/en-us/consumers/payment-technologi...