Maybe here (Italy) it is different, but AFAIK you need to login to the bank in order to do anything like changing the phone or the phone number, i.e. the 2FA is

Maybe here (Italy) it is different, but AFAIK you need to login to the bank in order to do anything like changing the phone or the phone number, i.e. the 2FA is sent for confirmation (on the old phone) only after you are logged in/authenticated (and this needs access credentials+2FA).