SecurId as implemented is sadly TOTP done right for the most sensitive accounts of very large organizations which are the cash cows to financials. They don't w

SecurId as implemented is sadly TOTP done right for the most sensitive accounts of very large organizations which are the cash cows to financials. They don't want cloning by copying a QR code. Each employee must have something they would have to physically share or it's not better than a longer password. They don't care if one employee is locked out for a week. I think U2F solves all the problems if the bank sends the pre-registered key, but standard TOTP isn't going to work.