HSBC Canada requires 2FA with a token or their mobile bank app. It also isn't possible to change account contact info, setup new Payees, transfer money to another country, without generating a security code with a token PIN. The contact centre agents are unable to access your account unless you can correctly answer the security questions. This does mean an agent can lock out your account though. It is a pain, but compared with the goofy BMO 6 character passwords, or worse using CIBC at all, it was a welcome change. Legacy systems galore: Scotiabank gave me a debit card once in a branch because I got angry with them and also use mail extensively (though they have a much bigger problem right now), TD Canada Trust and US TD Bank are integrated with mail and fax, and RBC has 3 different domains (not AD) (East, Central and West) and they are completely isolated which can be a nightmare when moving across the country.