> The payment processor can use 2FA (this is actually done by a number of banks in Europe, when you enter the payment information, you get a text message with a code from your bank to confirm the transaction).

I think 3-D Secure is the protocol they use.

https://en.wikipedia.org/wiki/3-D_Secure