Here in Denmark, banks typically use NemID; a government issued 2FA system. The basic version uses an OTP sheet of ~140 passwords. People can opt in to use phon

Here in Denmark, banks typically use NemID; a government issued 2FA system. The basic version uses an OTP sheet of ~140 passwords. People can opt in to use phone-based validation (push notifications to an app and confirmation with a slider). As far as I know (I don’t speak much Danish so I can’t look it up), this is a requirement to offer banking services in Denmark. I used to work in infosec for governments and banks. Typically, the only way to have these kind of things implemented is by having regulation that enforces it. Banks don’t want to have to foot the bill for 2FA, and they can (as another poster pointed out) claim the user was careless with their password to not have to cover phishing attacks. Most of the time, banks will claim that their user base is in remote locations and SMS-based 2FA is unreliable (believable in Oz), or that they don’t want to “inconvenience their customers”. The other issue is with choosing a tech. What if the bank picks wrong? What if it has an enormous cost? A bank in the UK decided to use smartcard/credit card based OTP, and it resulted in the torture and death of one or two foreign students. It’s quite simply safer to wait until you’re regulated to use a specific tech, just so that you can’t be blamed if it backfires.