My most charitable guess as to why banks haven't adopted TOTP or WebAuthn is a combination of: - TOTP having just relatively-recently become a first class citi

My most charitable guess as to why banks haven't adopted TOTP or WebAuthn is a combination of: - TOTP having just relatively-recently become a first class citizen on iOS and Android, - Not wanting to spend the money needed to educate their customers, many of whom can just barely text, on passkeys, and - Lacking regulatory pressure to force their hand. That said, I hate the trend of web services moving to "passwordless" auth schemes that rely solely on email or SMS .