For example, I’m using a domestic CAP-like system (dubbed Secoder in Germany) for several of my bank accounts. It exploits the fact that your ATM card is a trusted computer with a built-in digital signature/HMAC feature.
You have to spend 20 € for a small battery-powered device, which features a card reader, a display, a PIN pad and a camera. (There’s also a USB-based variant without batteries and camera.)
On each online transaction, you insert your card and point the camera at the QR-encoded challenge on your computer screen. The display then asks you to confirm recipient and amount, and if you do, it sends the whole thing to the ATM card, which then shows you the 2FA code based on HMAC.
CAP seems to have become a niche thing as everyone is preferring apps nowadays, and those are much cheaper to maintain. I still think the CAP system is superior to apps, because it’s offline, carrier-independent and easy to use.
[1]: https://en.wikipedia.org/wiki/Chip_Authentication_Program