Some do, but their backend systems are still vulnerable. Most folks here on HN would not believe me if I said that many of the back-end systems do not use encryption. There are still many automation jobs that use clear-text FTP on the WAN and for some jobs, even across the internet.
Some do. Of the four banks where I currently have accounts, only one uses SMS-based 2FA codes; the other three all provide chip-and-pin card readers or similar gadgets to generate transaction-specific auth codes.
