[zahlman]

It's used, as far as I can tell, because banks don't want to have to explain to millions of customers how to use anything else.

[reginald78]

Also because once they get that number under the guise of needing it for security they can use it for marketing texts. It's a win win!

[hypeatei]

It's perfectly fine if people want to use it, but at least provide the option for TOTP or hardware keys behind a big scary warning page or something.