[ryandrake]

2FA presumes user-ownership of the second factor, and that possession of the second factor authenticates that the possessor is the account owner. It's ridiculous because in the OP's case, he literally had someone else temporarily hand him the second factor in front of the clerk: the 2FA didn't really authenticate anything, and the clerk could even see that.

[bradlys]

Yes. It presumes things but it also allows the bank deniability. If you get completely hosed - it’s mostly on you for supplying a shit 2FA.

Come on guys. It’s obvious why banks have this. Everything identity related is stolen constantly.