Hacker News Reader

Royal Bank of Scotland and First Direct use a 2FA device that is authenticated first with your bank card pin (3FA?)

All the devices are the same (across customers and banks), so your card is the second factor, the device is just a reader for it.