Most in EU do this or will do - it’s part of EU bank regulation (PSD2). SMS isn’t considered safe anymore and debit/credit card payments are confirmed through banking apps (you get a push and confirm).

Wait, but smartphones are less safe than SMS. The attack surface of SMS is your surrounding, the attack surface of a smartphone is entire world, and virus infections happen much more regularly than sim copies.

That's not the issue though. I can log in to my cell account and see the content of every sms i send and receive. an app establishes an encrypted connection between your phone and the bank. sms is open to the public.

in addition, you don't need to copy a sim. you can copy a cell tower. which the authorities do all the time, without any warrants, and capture data en-masse. The fake cell tower fits in a backpack.

But it's not just the cops capturing your cell data. It's anyone, they've been doing it for over a decade, and it's cheap and easily accessible.

https://www.vice.com/en/article/vv7zn9/surprise-scans-sugges...

Online purchases with UK bank accounts often require this. Some banks use an OAuth-style redirect instead. I think the merchants get lower rates if they enable this feature (called "3D secure") because it lowers the risk of fraud.

It's basically 2FA for online transactions, which seems very sensible to me.

Reading the comment I was confused as well - it sounds as if the user provides his banking login to the merchant as part of the checkout process. However they mean that the transaction has to be approved via banking app, not unlike a 2FA authenticator app.

amazon paysend many others do too. bank is Boursorama

Is this something more popular outside of the US where credit/debit cards are not as ubiquitous?

I think it's called 3D-Secure for debit/credit cards. In Ukraine for example it is pretty much a normal path for online payments. Also our "credit" cards aren't the same your "credit" cards. Ours are basically the same as debit cards but with added overdraft amount and different service fees. They are created by the same banks as debit cards, not by a separate corporations.

It usually happens when someone pays with a credit or debit card. If the confirmation is not given in the app within a certain time limit, the bank rejects the card transaction.

Edit: to clarify, my comment is about the UK, and it does not happen with most card transactions; "usually" here refers instead to card transactions being the usual trigger (in my experience) for this app-based authentication flow.

"Usually" is a bit of sticky word here. Your usual is not my usual, hence my questioning of it. My experience is US centric, so I'm assuming non-US but non-US is a really big place.

Maybe. I never owned a credit card, however I also basically didn't use cash for years, only debit card

I've had a US debit card where 3D secure was triggered.