No! If I get my token stolen or cloned, that's my problem. When have you seen a service provider held liable for what someone did with credentials that were sto

No! If I get my token stolen or cloned, that's my problem. When have you seen a service provider held liable for what someone did with credentials that were stolen from a customer. If someone steals my bank card and uses it to buy stuff, the bank isn't going to be liable for that, so why would it be any different for 2FA tokens? As for behavior analysis for fraud detection: that isn't going anywhere any time soon, no matter if our tokens are clonable or not. And clearly the system your bank is using is dumb as nails, so I doubt there's a privacy issue there.