> Really what we need is reverse 2FA No. What we really need is a mutual authentication, where both parties talking over a phone can confirm each other's ident

> Really what we need is reverse 2FA No. What we really need is a mutual authentication, where both parties talking over a phone can confirm each other's identity simultaneously, as a part of a single process (assuming a previously established secret(s)). Ideally, with a piece of human-readable metadata attached to it that describes the purpose of authentication. So banks no longer ask you to read back a SMS, and you no longer guess if that's legit and you both know what this authentication is for (spelled out in a natural language). If you have Internet connectivity, it should use it to perform all the communications, leaving both sides with a simple interface (as simple as tapping "confirm" or "reject"), and if Internet isn't available it should provide an ability to still perform the protocol by reading some phrases and typing in what you hear back.