I think all the banks that I used for the last five years (from three different European countries) use the mobile app itself as a generator of security credent

I think all the banks that I used for the last five years (from three different European countries) use the mobile app itself as a generator of security credentials. The app itself is pin protected. Recovery paths vary -- from sms and hardware code generator (funny terminal to slot bank card into) to government-managed PKI or id carda. I think only one of them is still using sms as a fallback for normal transaction confirmations.