Both are rather strict on having a clean, non rooted, non modified phone. Currently, they both work without any caveats, but I had to install magisk, add them to magisk hide, and use the magisk renaming feature to have them work.
Personally I wouldn't suggest having banking apps on a phone.
You can always use the web browser if you absolutely must access those accounts.
Visa and Mastercard also introduced 3DSecrue system which piggybacks on the same system of confirmations. Vendors are incentivised to adopt it by lower rates.
In essence when paying with card or making a wire transfer (or using some instant transfer method, for example Blik in Poland), you get notification on you phone asking you to confirm operation, even if you initiate it from your account in the browser.
In essence Bank apps became 2FA devices. The only way to avoid it is to opt-out of the App 2FA and use paper one-time code pad. You regularly then get sent a list of codes by snail mail, which you have to type to confirm operations.
They can and do. There are a number of banks where you have absolutely no choice.
Basically, there's a common (government-backed) user identification system which hooks up to interfaces that banks provide. When you're logging in to an online service that requires strict identification of the user (such as ones that would require an official id document if done in person), you first pick the bank you're using, and the service forwards you to the bank's website. Once you log in with your bank credentials, the original requesting website gets informed that you've provided valid login information, and the identity that the login matches with.
I don't know the exact technical details of how that works, but essentially the bank also acts as a user identification service for various official and governmental online services. It's treated as similar to proving your identity with a document, or to signing a document with your signature.
I don't know if this is a common thing in other European countries, but if it is, that might be a reason why the EU has an interest in enforcing 2FA.
You're not strictly required to use a smartphone, as at least my bank has other means of 2FA that satisfy the regulatory requirements, but they are more cumbersome.
Do you live in Denmark perchance?
> I don't know if this is a common thing in other European countries
There is a similar system implemented in Poland and works very well.
There are some rules here that are nonsense, such as know-your-customer laws that force me to enter my home address even when the product or service (say, a concert or train ticket) is delivered to me entirely electronically.
Most of the move to purely electronic payment is driven by the market and the large banks; e.g. in the Netherlands we actually never had laws that force shops to accept cash as payment.
So it's possible to do that with some of the banking apps.
FYI in New Zealand a few banks can provide a device (e.g. RSA SecurID) for proper non-bank 2 factor auth with consumer accounts. However some major banks only use phones for 2FA (app or SMS).
The norms seem to vary considerably depending on country.
Yes, I'm bitter. If there's ever a bank that puts end-user automation first, I'll switch in a second.
However when I really wanted a solution i build a small service that receives the confirmation SMS most banks offers and pushes my balance in a small API.
Vanguard works on my completely google-free phone, although I had to change the OS language to English because w/ Android set to French their app would force the use of commas as the cents separator, then complain that commas are not a valid character. Another fun thing was it uses its own internal camera app, which would focus the preview, then completely ignore the focus setting and take a blurry photo of the check. Eventually I figured out the camera's default focus length and take the photo from that distance.
in addition, you don't need to copy a sim. you can copy a cell tower. which the authorities do all the time, without any warrants, and capture data en-masse. The fake cell tower fits in a backpack.
But it's not just the cops capturing your cell data. It's anyone, they've been doing it for over a decade, and it's cheap and easily accessible.
https://www.vice.com/en/article/vv7zn9/surprise-scans-sugges...
It's basically 2FA for online transactions, which seems very sensible to me.
Edit: to clarify, my comment is about the UK, and it does not happen with most card transactions; "usually" here refers instead to card transactions being the usual trigger (in my experience) for this app-based authentication flow.
Huh? This is not a real thing.