[hocuspocus]

I meant neither by phone (SMS tokens don't meet the DSP2 requirements) nor a mobile app.

The card issuer can send you a one time link to a web portal by email or using an iframe, where you log in and confirm the transaction.

[culturestate]

Interesting. I've had cards with email confirmation flows (AmEx) but they send an OTP, not a link. I don't think I've seen what you're describing.