I’ve seen banks where the OTP code is generated on the client and then sent to the server.