We're talking about how banks should be adapting away from this signal, so perhaps they should support WebAuthn and/or TOTP?

It would honestly be revolutionary for a bank to require hardware authentication and send a security key to every client upon registration.