Good point. They don't. Huh, that's really worrying. My bank started requiring phone for web portal only about a few years ago. They don't allow to use an alternative MFA method. This should be made illegal.