This highlights what I see as the biggest security weakness with banking and online services -- identity verification is only one-sided. Protocols like password

This highlights what I see as the biggest security weakness with banking and online services -- identity verification is only one-sided. Protocols like passwords , pins, biometrics, secret questions only authenticate the customer and not the service provider. moreover, no one is talking about this huge weakness. For there to be trust, both sides need to be trusted. For apps, this could be a one-time code validated in the app. As a fall back there could be a unique shared "service pin" that gets rotated.