By that logic, you don't need an OTP code at all, because your adversary "shouldn't" have your password or PIN.
The entire point of two-factor authentication is to provide an extra layer of security for when the first layer is compromised.
The entire point of two-factor authentication is to provide an extra layer of security for when the first layer is compromised.
Having the possibility/capability of intercepting the SMS is only effective if the ID and PIN are already known, and while surely there are "other" ways to get them, the attacker needs all three.
From what I have read/seen, most if not all successful attempts to access someone else's bank account online go through some form of phishing.