You know why this is stupid? Originally they had hardware tokens.
Hardware tokens are secure being totally out of band however the western companies that produce hardware tokens are a bunch of greedy companies as usual so the battery on these tokens run out easily.
The cost is too huge for banks so they cancelled hardware tokens.
Guess what China banks are using their own hardware tokens with long battery life and standby times.
1 token easily last for a few years and therefore they are still using it.
Trying to solve the problem the stupid way.