Then don't issue an app. Issue people cards to pay with and let them come to the bank for weird transactions.
[1] https://en.wikipedia.org/wiki/Transaction_authentication_num... (This is a bit outdated, nowadays it works via QR codes instead of those flickering barcodes but the concept stays the same)
And the website and app of my bank with offices is ... how should I put it ... a bit Kafkaesque.
The obvious thing banks should be doing is putting fucking restrictions on these accounts by default and let people ask for exceptions.
And of course if regulations don't encourage them to pick social-engineering-proof defaults then things won't improve.