But you do use 2FA when paying with your credit card online. What kind of 2FA does the bank providing your credit card mandate you to use?

In Denmark, there's a national system for authentication used for government sites and banks. I have a small device with a single button on it that shows a 6-digit code when you press it. I enter that code along with a password any time I make a purchase online.

(There's also an app that most people use. But I like the hardware thingy better.)

For me (in France) it's the bank app's 2FA or sms 2FA if not available.

My bank's app.