Or worse.

My bank closed down their old online banking site and the new one needs the phone for 2FA... but ... drumroll ...

... the idiots also want me to keep using the token device to log in before approving the log in via my phone.

Security theater.

So switch the bank? Worked for me.