If they used SMS to identify the customer, isn't it a form of authentification? Having the credit card/credit card info is the first factor and the second factor seems to only have been being able to receive the SMS to confirm it wasn't fraud.

I've experienced better banking apps which did use SMS at the initialization, but coupled it with other identifying factors (eg the phone IMEI or a code sent through postal services). If these app needed to be reinstalled the whole verification process would have to be redone.

My CC company sends fraud alerts via email as well as SMS. They all should.