They're more than MFA codes though: they're actually performing cryptographic challenge/response.

I mean: the RSA tokens just generate a MFA code. But the bank "card readers", whether they actually read a card or not, do perform challenge/response.

I've got several banks using the same type of card reader: I put my bank card in and respond to a challenge: I enter the digits that the card reader shows me and I can log in.

I've got another bank which provided me a reader: it's not a card reader as its standalone (I don't need any bank card to use it) but it still perform challenge/response.

For example for any wire tx to a new recipient or above a certain amount, I need to enter the amount and part of the recipient's bank account number and sign the transaction.

It's more than just authentication.

Defeats the purpose? Only kind of.

In between there was a special key-generator given to each customer, that was abandoned about 10 years ago. (edit: it was the RSA SecurID's mentioned in this thread)

Since then we've got apps that need to be activated using a letter with a special qr-code, as well as the bank account-number (username) & password another qr-code from the website. I assume it generates a private key in the app which will not be transferred to a new device (but maybe somehow is). You need to login using your account-number (username) and password, after that you have to open the app (login with face-scan) scan a qr-code and enter the generated code.

Getting a printed out card or page with something on it to verify your identity seems like 20 years tech to me.