Probably SMS or in-app 2FA. That's what annoys me about banks: they claim to do things for security -- which in their case it makes sense because they don't need to harvest data to make money -- but then go ahead and roll their own instead of using standards.