> Would the reset request not have come to an email account, presumably a well-protected one? Not in this case (and not in many); verifying access to a phone n

> Would the reset request not have come to an email account, presumably a well-protected one? Not in this case (and not in many); verifying access to a phone number is also common and apparently was an option for this bank.