Wouldn't a one-time code still allow the attacker to make one transaction later on? Perhaps the solution is to require a button to be pressed or a switch to be

Wouldn't a one-time code still allow the attacker to make one transaction later on? Perhaps the solution is to require a button to be pressed or a switch to be flipped on the card before or during the scan. Although this would make using it slightly more inconvenient since you would need to open your wallet to push the button or flip the switch.