And even that effort demonstrates the incompetency of most financial institutions - anyone with a security team worth their salt would have mandatory two-factor

And even that effort demonstrates the incompetency of most financial institutions - anyone with a security team worth their salt would have mandatory two-factor authentication, which would make the approach unworkable.