I noticed banks have generally modified their message to warn people: “Please use 123456 as your TD security code to log in. We will never contact you for this code. Do not reveal it to anyone else.”

Only HSBC requires a token to authorize transactions that I have found so far (token +PIN) Most happily let you do anything once logged in.

That said, I am sure we have all heard someone complain, “Why am I getting these login codes from my bank? I am not trying to login”. Most people don’t make the connection to fraud attempts.