This is a huge problem in EU countries!

The relevant regulations are Commission Delegated Regulation (EU) 2018/389 and the earlier Directive (EU) 2015/2366.

While these laws are deliberately vague when it comes to specific technologies, they do require at least two independent factors from different categories, such as knowledge (password) and possession (phone).

That, in and of itself, wouldn't be a problem. The way most banks implement it, however, is by giving you two choices:

1. You use their mobile app (which likely requires device attestation and Google Play Services, so won't work on a plain LineageOS install)

2. You use their CardTAN device, which is extremely inconvenient to always carry around.

Sure, we nerds might argue they should just let us use our Yubikeys or regular old TOTP, but pretty much no bank implements that. (Why? Your guess is as good as mine.)

Personally, I had to buy a second stock Samsung phone just for banking apps. And yes, there are still alternatives (only very very few though), but no, none of them are convenient, for various unrelated reasons.

I wouldn't be surprised if this continues to spread to the US too, under the sneaky disguise of "security".