it used to by the bank, now the minimum security is defined by the Payment Services Directive
which is quite specific
Re:FedNow FAQ
by kevin_thibedeau on Thursday August 18, 2022 @05:55PM
(#32515350)
Forcing people to use a smartphone is still a fail.
Monzo for instance just requires that you are signed into the app and can face-ID on iOS.