The PSD2 directive mandates the 2nd factor to be able provide you with an independent means of displaying the transaction you are performing. This essentially means the 2nd factor must be an device.

In the US "people with smart phone" is larger than "people with a computer." The real people being left behind are "people without email". I have a neighbor in this state and we occasionally have to make a temp email to qualify for various discounts or the like. It would only muddy the waters if we anyone thought he actually has an email.

There are usually alternatives that you can get, like a little calculator-looking thing that generates one time codes. What really surprises me is that despite needing 2FA to make any transactions, some companies like Amazon still have the ability to magically get money from my account using only the info on card.

In the EU no bank is allowed to operate without safe 2FA (no SMS) due to the PSD2 directive.

“or else separate authentication hardware.” It doesn’t require a smart phone. You can also get a ~$25 photo TAN device or similar.