I'm not sure why you've been downvoted for this - it's a perfectly legitimate question. I'm in the UK and have a personal account with HSBC and a business acco

I'm not sure why you've been downvoted for this - it's a perfectly legitimate question. I'm in the UK and have a personal account with HSBC and a business account with Lloyds. In both cases I need to generate a code to setup a new recipient - using the app (HSBC) or a physical card reader (Lloyds). I also get an SMS in both cases asking me to contact them if I didn't submit the request. So anyone gaining access to my accounts wouldn't be able to transfer money out. I suppose they could do other things - contact the bank's support staff using their realtime chat thing maybe and social engineer something that way? Perhaps they don't ask for further confirmation in that case but I haven't checked.