> Even if it has been done before (I have no idea)
I had this idea myself, I Googled it and found nothing. Visa has 3D Secure (which is really just a text-delivered OTP), but implementing the standard is completely optional. I've only come across it on a handful of websites.
Pity it's US only for now.