Comment by zamalek

My bank recently added the feature of removing SMS as an 2FA option - requiring TOTP. Now if they'd only add webauthn, but TOTP is pretty secure against phishing with a browser-integrated password manager (no autofill results in suspicion).