Hey Alex,
OTP codes are based on a shared secret and require manual steps of entering them with time pressure. (Imagine all types of users.)
The latter will be a problem for non techies who aren’t as quick as techies are, needing to start over.
Secondly, the shared nature means that whatever tool or system you save the OTP generator, this tool determines if it can be duplicated. Some allow for copying of the shared secret. So it is not an absolute bond between you and your bank. (The latest example showcasing risk is Google Auth’s app pushing an update that after years introduces sync without encrypting the data.)
At the moment (2023-07) bunq’s 2FA is the record-a-video-of-your-face-rotate-and-say-a-number-oud-loud process.
Not sure if this can be called 2FA but it very strong because it is human-identity based and a very guided process.
That being said, beyond OTP, more modern forms of MFA would be interesting like WebAuthN for those who want it.
This includes FIDO2 security keys as well as Passkeys. The first might require a PIN, the latter doesn’t and is Passwordless, relying on Touch ID, Face ID or similar device-local authentication to access the Passkey.
Would this cover your wish as additional factor?
