> We follow a "trusted devices" model, where you 2FA using your phone number for the first login on a device

It sounds like associating and verifying a phone number is required to sign up and use the service - is this something you're open to changing?

> I assure you there won't be a "refer your friends" badge blinking on the home page of the app

That's great! And TBH I wouldn't mind terribly as long as it can be permanently disabled after a first view.

> We hear from most people that iOS or Android are their preferred platforms, so we have to start there

Understandable. At the very least it would be a huge boon if we can expect to run the Android app without hickups on a fully degoogled Android device (e.g. GrapheneOS).

Will keep an eye on how things develop :)

>It sounds like associating and verifying a phone number is required to sign up and use the service - is this something you're open to changing?

Are you looking for something like Authy or Google Authenticator here?

Precisely! Both are implementations of TOTP[0] - it's a simple protocol which doesn't rely on any particular implementation.

The other common one with that same characteristic would be Fido U2F[1] (for hardware keys such as Yubikey and Google Titan). If/when you do implement it, make sure to support adding more than one token to facilitate users sorting out their own backups.

Both are open standards that are well-supported with both proprietary and open implementations across platforms.

If you have to initially only pick one of the two I'd go with TOTP.

[0]: https://en.wikipedia.org/wiki/Time-based_one-time_password

[1]: https://en.wikipedia.org/wiki/Universal_2nd_Factor

While many will raise concern with the UX of having to carry around hardware, in the fintech world I think it's a good tradeoff and raises the bar for the industry (I always shudder when I see "we use industry-standard protection"). :)