Maybe banks could use a way to authenticate the user a second way, that doesn’t involve a password. If only. (Sidenote: why do banks still insist on sms 2FA?)