To add to what woliveirajr writes, the technologies that banks are starting to implement to increase the authenticity and integrity of transactions are not foolproof. This is a classic example of a great technology that may have missed a few things in its implementation. Specific to the blog entry, Litan seems to describe that the adversary knew when the out-of-band (OOB) transaction was being initiated and modified data in-flight.
I assume that OOB, in this example, was not a completely separate physical channel. But it's also possible that the implementation of the communication channel included sufficient information for an adversary to modify account numbers without being detected. For example, if the protocol for authorizing a transaction transferred account numbers and the OOB auth device only "proved" the identity of the end-user, an adversary can easily modify the transaction data without the end-user realizing what happened. Again, security technologies tend to break when the implementation sucks.
AFAIK, researchers from Cambridge first published an attack on EMV.
The benefit of OOB exchange increases the difficulty for an adversary to launch an attack. The users' PC might be compromised, but a hardware device may be much more difficult to compromise. The chances of an attacker compromising both the PC and OOB auth device is much lower than the chances of an attacker compromising just the PC. However, poor implementation can easily render additional controls (i.e. OOB) useless and the costs are greater because the users believe they have greater security though they do not.