While I like the spirit of this thread of work-around suggestions, I can't help but think that using $RandomService to verify access to someone's bank account is a terrible idea.

It's bad enough having banks rely on a phone system where most carriers are perfectly happy to let anyone who knows your Address, DOB and Mother's Maiden name to port your phone number to a new SIM.

It probably requires less effort (and certainly less risk of discovery) to take over a Skype, Google Voice or other VOIP/SMS service.

It's a terrible idea, but until banks and other websites quit weaponizing 2FA in the name of security theater, workarounds like this are sometimes the only option.