Hacker News Reader

Bank of America offers FIDO U2F as a second factor but doesn't let you remove SMS as a factor. I don't see what the point is.

It doesn't do anything about SMS delivery based threats, but U2F at least makes authentication itself unphishable.