Also, the cost of the "convenience" of not having 2FA is that they have to be hyper-vigilant about looking for fraud. I've had my RBC account locked twice this year because I use a VPN sometimes.