I disagree. TOTP-based 2FA is leaps-and-bounds more secure than SMS based 2FA and will stop nearly all attempts to access your account.
The fault here lies with victims answering a prompt to enter their 2FA out of the blue. Just as with passwords and other such info, the bank will never request it for no reason.
A hardware token using webauthn protocol is most secure though, yes.
The fault here lies with victims answering a prompt to enter their 2FA out of the blue. Just as with passwords and other such info, the bank will never request it for no reason.
A hardware token using webauthn protocol is most secure though, yes.