[seszett]

La Banque Postale also asks you to confirm in their app, what we see here is the case when someone has not activated the in-app confirmation (called "certicode", uses another password that is different from the account password).

Apparently just SMS is not deemed secure enough by law, so they have to have another authentication factor, and the only other factor they have if you haven't activated certicode is the regular account password.