Nice point. A notification just-after is almost as good as authorization just-before. An exception I see is that it works even when your phone is off, so you w

Nice point. A notification just-after is almost as good as authorization just-before. An exception I see is that it works even when your phone is off, so you wouldn't be aware of the notification (or so I assume - do some phones buzz/beep, even when off?) Of course, it makes it riskier for a malicious cashier. I suppose they could check who has their phone off first, but the risk is certainly mitigated.