[culturestate]

> Some card issuers don't require it done via a phone

And some (looking at you, DBS) toggle seemingly at random between requiring it via SMS or via their mobile app.

[hocuspocus]

I meant neither by phone (SMS tokens don't meet the DSP2 requirements) nor a mobile app.

The card issuer can send you a one time link to a web portal by email or using an iframe, where you log in and confirm the transaction.

[culturestate]

Interesting. I've had cards with email confirmation flows (AmEx) but they send an OTP, not a link. I don't think I've seen what you're describing.