Used to be the case, yes. However even web-initiated EMTs trigger device confirmation. RBC seems to have made this mandatory for at least my account as of this summer.