Regulation requires 2-factor verification of sign-ins and transactions (and no, WebAuthn and TOTP aren't allowed). That leaves three options:
* Physical hardware (what?)
* SMS at 9 cent each
* An app
* Physical hardware (what?)
* SMS at 9 cent each
* An app
Why not? If you say "security reasons", then why is SMS allowed, since it's way less secure?
> SMS at 9 cent each
What places still charge for SMS?