I've always thought this was a smart choice. Australian banks authenticate their transactions: "The code to transfer $100 to Joe Bloggs is 4321. If you're sur

I've always thought this was a smart choice. Australian banks authenticate their transactions: "The code to transfer $100 to Joe Bloggs is 4321. If you're surprised to hear about that transfer, call the cops now." This makes a lot more sense than authenticating a login, which doesn't give you access to especially valuable information on its own. Historically, there was a period of 10-15 years when these banks had websites, but you couldn't make arbitrary transfers through them. You could read your statements, and you could pay utility bills where the bank trusted the biller. Logins and passwords were appropriate then. The SMS authentication was only introduced later, when the websites could do things that required it. No doubt it made sense to save the SMSes for when they were needed, which was rare before people got used to paying by internet transfer.