I'm always amazed reading that this isn't already the case in the US. In India, every charge requires SMS based 2fa. Starting a bank mandate (ECS/NACH) for automatic transfers needs me to physically sign a paper. It can be revoked any time by the user without any involvement of the receiving party, and can be done online as well.