Banks don't necessarily need strong authentication, because that isn't what they are trying to guarantee. Banks have contracts that often guarantee something cl

Banks don't necessarily need strong authentication, because that isn't what they are trying to guarantee. Banks have contracts that often guarantee something closer to "eventual consistency", where the ability to rollback or correct transactions is more important than guaranteeing any single transaction is correct at first. In the unlikely event of a problem, they can fix it. The bank judges how much risk they want to take and uses whatever level of authentication they feel is necessary, which might be as little as asking your name and/or account number(s), or calling your phone listed on your account.