Thank you for your comments. My credit card megacorporation will randomly block my online purchase and send me an e-mail asking me for that yes/no response that you mention, Except my corporation wants me to click on yes which opens a browser tab. Not even an app. Anyone sealing a mobile device can do that. It's one reason why I don't do anything financial on a mobile device. And yet, these tech people think 2FA is a divine gift to humanity.