Don't all banks do this? Here in the UK it basically seems mandatory. Try to change your password/phone/email, they'll send you an actual letter which has a passcode you need to enter in to the website. Although mine took only a day to arrive.

No, (I'm also in the UK) I've changed a few recently-ish and in each case had only to answer some security questions and then receive a phone call/text message with a code to enter.