HSBC also did this. For business they use hard tokens. IIRC they were moving personal accounts to hard tokens too, I moved countries and lost access to my online account because of this (there was no money there, I tried to get them to send me a token to my new address but the person I talked to was hard to understand and the token never arrived).