I think they're implying they can glean all that information based on the 2fa codes you receive. eg. "your security code for First Bank Of HN is: xxxxxx"

Which don't contain the bank account number (at least in any 2FA I've ever received from a bank.)