This is definitely not the case everywhere.
Where I live the app is 100% needed because it’s the „second factor“ in the login process.
Where I live the app is 100% needed because it’s the „second factor“ in the login process.
Fallback should never be the weakest link in a security chain. Especially not in something as high stakes as your banking login.
I can’t remember how I got my first bank token in my phone. Probably by physically showing up in the bank office with my id.
The secure enclave on a rooted phone that no longer has execution integrity?
If your SMS OTP leaks to the attacker, they still need to know the first factor (password, biometrics) to gain access.
Meanwhile, if your rooted phone is controlled by an attacker ... that's it, the attacker has everything.
Well, some offer a hardware device for like 25€ that can do the same thing, but then if you have an account with multiple banks, you need multiple of these devices.