I came to an alternate conclusion. While cellular network operators generally have abysmal authentication procedures they are not responsible for bank fraud. If

I came to an alternate conclusion. While cellular network operators generally have abysmal authentication procedures they are not responsible for bank fraud. If a bank relies on SMS delivered codes to confirm large funds transfer, they have taken a measured risk in offloading identity binding to a third party. Banks could use TOTP, USB dongles, CAP, have a customer support employee check knowledge based questions, physically mailed TANs, app push notification, etc. But SMS is used because it’s cheap, less worse than passwords only, and most people have a cellphone.