That's basically how it used to work. Before the app my bank required the use of a card and QR reader with a screen that could authorize transactions