Last week, I called customer care to cancel two add-ons on my DCB metal card, which shared the same number as my primary card. The very next day, I applied for new add-ons online and got them a few days ago, each with different numbers. The add-on holders also have accounts and their own credit cards with HDFC bank. They get OTPs and transaction emails, but I don't get any alerts when they use the add-on cards.
I noticed they've added the cards to their internet banking (though it doesn't show on MyCards), where they can control everything like transaction types and limits. They can even set the PIN without me doing a thing. Here's a screenshot from one of their add-on card accounts (New UI). It looks like it's dormant since they haven't used it yet.