Probably SMS or in-app 2FA. That’s what annoys me about banks: they claim to do things for security – which in their case it makes sense because they don’t need to harvest data to make money – but then go ahead and roll their own instead of using standards.