Although it's not two-factor, some banks will send you push messages or texts for every transaction taking place on the card. I use Simple, they do the former.

Although it's not two-factor, some banks will send you push messages or texts for every transaction taking place on the card. I use Simple, they do the former. One nice feature about Simple is you can disable the debit card directly from within the app, and then re-enable it if you need to (for example, if you lose your wallet temporarily). Simple also sent me a new debit card automatically without prompting, their systems having noticed I'd shopped at Target last week. The problem with the two factor system as you describe is that while it works for 'cardholder not present' transactions (and there already exist standard two-factor methods for such payments, not that many banks use them), it would make retail POS payments incredibly slow. You'd have to wait for a text/push, you might not have any reception, then you've got to reply, etc. This is one reason why EMV is, for all its failings, more attractive than mag-stripe: it is considerably harder and more expensive to clone EMV cards.