> These are banks. It took them over a decade to only finally implement SMS 2FA. A lot of the slowness is driven by regulation and especially the slow decision

> These are banks. It took them over a decade to only finally implement SMS 2FA. A lot of the slowness is driven by regulation and especially the slow decision-making that leads up to regulation. In the UK for example, I cannot think of a single bank that uses SMS as a 2FA channel for internet banking. Some card providers (Amex for instance) do currently provide one time codes for card purchases via SMS, in an attempt to be compliant with PSD2’s Strong Customer Authentication (SCA) rules, but I suspect this’ll change soon because the EBA has already indicated that SMS based SCA is not acceptable[1]. It’s worth remembering that ultimately, SCA or not, banks and do bear liability for fraud not due to the customer’s negligence (in the UK at least), so that’s the ultimate backstop to whatever tech they choose to deploy. [1] https://www.ensygnia.com/blog/2019/7/11/sca-otc-not-ok-says-eba https://www.ensygnia.com/blog/2019/7/11/sca-otc-not-ok-says-...