It's Bank of America, so it's about as feature-filled as a banking app gets. You can do all the normal stuff like check balances and deposit checks, but you can also open new accounts (including credit cards) and transfer money (between other accounts you own or to other people outside the bank). And yes, the app has the ability to add new transfer recipients, which only needs their email address or phone number. There is a protection to guard against unauthorized adding of new recipients, but you guessed it, the protection is in the form of a 2FA code sent via SMS. So if you're already in the phone and in the banking app you can add yourself as a transfer recipient with your email address and verify the recipient addition because you can read the incoming text messages too. And the warning email that comes when you add a new recipient and initiate a new transfer is likely going to come to the same phone you're currently holding. If you get into my banking app through my phone you can send yourself as much of my money as you want and cover your tracks so I wouldn't know until my next statement comes, and to top it all off, it looks like I was the one who sent the money to you, so how am I going to argue that I didn't?