Surely even banks/countries that do not have a stronger auth method require at least a password for login?