the main issue is the bank using sms and OTP apps instead of something like passkeys and mandatory in bank setup.
A fundamental difference with e.g. FIDO2 (especially hardware-backed) is that the private credentials are keyed to the relying party ID, so it's not possible for a phising site to intercept the challenge-response.