Pretty much the same thing with Chase. I had to access my account while overseas and had a somewhat similar story. The mobile app doesn't require a second fact

Pretty much the same thing with Chase. I had to access my account while overseas and had a somewhat similar story. The mobile app doesn't require a second factor, so I was able to log in there, but I couldn't transfer funds or something on mobile, and buried in a deep section of the settings I found a way to get the OTP via email. Really disturbing the banks still haven't secured this.