Depending on the bank the controls vary. For example Natwest require multiple factor to setup the destination bank account the first time you do a transfer and

Depending on the bank the controls vary. For example Natwest require multiple factor to setup the destination bank account the first time you do a transfer and then less authentication on subsequent transfer. Multiple factor because you would need to know my online account number, online pin code, online password be in possession of my bank card, use a Natwest card reader that authenticates me using chip and pin. Yes it's a frustrating way to pay a mate £5 but does make it a lot harder to be attacked.