A one-time code was sent to the cardholder's registered number.
No customer interaction required — issuer approved via risk scoring.
Issuer declined the challenge. FOP not created.