A different solution is being deployed in the US for both debit and credit which mirrors to a certain degree a solution that has been in place for much of the EU. Credit and debit cards include a chip that is inserted into a card reader, generating a single-use payment credential that, if intercepted, generally cannot be reused.
Why this system and not another? Historical dynamics and inertia. The US has long had a system where the card, or card + PIN, functioned as a bearer credential. To introduce a new model where the user has to actively verify transactions using a second factor like SMS would require cooperation on the part of retailers, card brands, banks, cell network providers, not to mention users.
Of course there have long been card brands that on exceptional transactions would ask for the customer to call them, or will call themselves, to confirm. But this is the exception, far from the rule. The thing is that as much as it makes the news, fraud is simply not that common in the US, even under the card swipe system. It impacts no more than a single digit fraction of transactions.