Several British banks use Chip+PIN cards to provide a token — not necessarily for login, but for authorizing a transaction.
Like this: https://c7.alamy.com/comp/CYGATP/online-banking-security-chi...
I have several hardware tokens for banks; the one of the Rabobank is as big and heavy as some phones :/ It has a camera and color screen built in. Secure but jikes I don't want to drag it around. The rest all do SMS only; I have never heard of 2fa via email; that sounds like the worst idea ever.
>I don't know any bank that supports token-based 2FA
Wells Fargo supports RSA SecurID tokens.
Source : I have one.
However, they also support SMS as an alternative. I'm not sure if SMS can be disabled..
One way to help protect you is to visit your carrier's retail store and have them turn off online access to your account and require all changes to your account to be done in person with a valid government ID. This should make it more difficult for number porting attacks but they can still sniff the SMS message when goes over the cell network. As far as I know, mobile network control messages aren't protected.