>Indian companies can't charge my debit or credit card just because they have the card number, expiry and CVV. I have to approve each transaction with my bank.

>Indian companies can't charge my debit or credit card just because they have the card number, expiry and CVV. I have to approve each transaction with my bank. True for Indian companies but what if you get charged via Forex abroad? For me - Google or Steam - don't required 2FA. All I have to do is to enter my number, confirm CVV then zap. It gets debited. I do get a call from my bank (HDFC) asking if this transaction has been initiated by me, if I say yes, they let go.