Hacker News Reader

We use SMS OTP as a second factor. Although banks of course want to save some cents and use push notifications for those who has a mobile app.

View on HN

The EU has regulations requiring banks to move to an app with device and app integrity checks. SMS 2FA is temporarily permitted for backwards compatibility but is explicitly considered a legacy approach that's being phased out due to being insecure.

SMS OTP is not very secure relative to a push notification to an app

Reply on news.ycombinator.com