The 2FA should be online. Doing that in person sure has issues for online banking.
Earlier today I got a text about that I should call the bank about another fraudulent transaction. I didn't, because I'd probably get someone who can't speak English, and I assume they'll terminate the transaction if they can't get hold of me. 2h later they called me, didn't pick it up, due to the same reasons and because I was in a meeting. I've cancelled the card now.
It makes me also curious where they got the info from, since no vendor I bought something from online has reported a data breach

.