My bank (Australian) requires SMS-based two-factor authentication on international transfers -- they send a one time code in an SMS to your registered phone num

My bank (Australian) requires SMS-based two-factor authentication on international transfers -- they send a one time code in an SMS to your registered phone number, and you have to enter that, as well as re-entering your bank website password, before the transaction will proceed. Works anywhere in the world as long as you have your phone with you. You can change the registered phone number only by calling the bank and passing a set of identification questions posed by a human operator, so there has to be some significant identity theft to get past it. I don't think that would be particularly hard for a determined and experienced thief though. I guess it hinges on what the meanings of "fancy features" and "everything should just be rock solid" are. I tend to agree with your earlier comment that for the banks this comes down to a risk assessment and a cost/benefit equation.