That still requires getting personal information about the user, which is often enough without 2FA. 2FA still makes it more secure than not having it. It's still a vulnerable step though, so users should be aware of that.

Start talking to someone at the credit Union. They are run by people, you might be able to convince them the risk and implement a safer method