Most online merchants redirect me to my bank's web page when I enter my Visa credit card number. In theory it should be possible to have a card number that by itself is useless and always requires an external confirmation?
with a mastercard from a swedish bank that is the experience that i get. all online transactions pop up a page from my back with qr code, this is authenticated through an app that shows me the transaction details and requires pin confirmation.