Most banks in the US still use SMS password reset.

PNC is so bad they even have “secret question” password reset, last time I saw it, e.g. “what’s is the name of your cousin”