Amex offer to email me with a OTP. I guess those without email probably don’t have much to worry about given that they’re unlikely to be doing much online shopping.
SMS tokens are on their way out as they don't satisfy the security requirements.
In this case you need to log in to your bank website and accept the transaction.
I believe all banks implemented SMS and an APP, and some banks also have hardware OTP tokens