>Close to every bank in the EU requires their user to have an app

Possibly this was hyperbole but in any case it's not correct at all.

Anecdotally, of my two EU (massive legacy French) banks, neither requires a mobile app. SMS all the way.

Even Wise, a cutting-edge neobank, does not require you to use its app. And its website accepts standard TOTP authenticator for 2FA.

Revolut is app-only, which is why I never use it.

> Anecdotally, of my two EU (massive legacy French) banks, neither requires a mobile app. SMS all the way.

My wording was bad, sorry; but try to install their app just once. After that, I'd bet you won't ever be able to go back to SMS validation (which is what I was talking about at the end of my comment).

If not, I'd be curious to know the banks you're talking about (to consider switching to them, for one thing). What I said above is true of Caisse d'Epargne, HSBC, CCF, among others.

Here in The Netherlands banks used to offer authenticator devices, which they are phasing out (you can still use them, but they wont replace them once they run out of battery). Pretty much all banks switched to app-only.

No SMS at all (which is not surprising, because SMS is not secure).

Also, IMO fingerprint/face-based authentication is much nicer/quicker, especially for online payment flows like iDEAL (Dutch predecessor to Wero). And banks here work on GrapheneOS, so not much is lost.