I don't understand why banks and businesses don't outsource the whole authentication business to someone that does nothing else, and then does proper 2FA (maybe with a choice of security levels), and supports as many standardised solutions as possible.