So here's a problem with banking "2FA". It's not clear what the number they send you by SMS is used for.

My Gmail account has 2FA. The token is only used for login. If anyone asks me for it over the phone, there's only one reason.

Banks use 2FA sometimes at login, sometimes over the phone, and sometimes to authorize transactions. That should be made transparent in the message, but it usually isn't.

Imagine: "Your temporary pin for identity verification is 373123, and expires in 5 minutes."

"Your temporary pin to authorize a transfer for an amount ending in $xxx4.23 is 522185 and expires in 5 minutes."