Typically the website requires you to use the mobile app as 2FA. Typically also there are less and less brick and mortar locations.