If your using a computer and a phone Then yes your correct. If you use the same smartphone to login and authenticate. IE, login via web browser, get a text, sms, push, etc on the same device then it's not TRUE OOB/MFA according to PCI oob/mfa requirements.