My banking app requires a pin (or fingerprint) to read data, and a password to make transactions.

The website requires a temporary code, generated by a card reader and my card. It works like a 2FA code, as I need to _have_ my card and to _know_ its pin.