Instead, the 2fa app should show you the action you are authenticating, just like the SMS version. But actually, we have put way too much stuff on the (inheren

Instead, the 2fa app should show you the action you are authenticating, just like the SMS version. But actually, we have put way too much stuff on the (inherently transient) web. What solves your problem is permanent client-side storage. Your friend shouldn't reach the bank through a google search.