What I don't understand with banks is that they make it too easy for you to change yr phone as new digital token. The least they should do is video call when you're creating signing a new phone as token. Not just through email and sms 2fa authentication OTP.
Think about it, if you hardware token is battery weak and need to change, you need go to to physical store where they have to verify you in person that you're the owner of the account, before disabling the old one and issuing a new one.
But if yr phone get hacked and they know yr email and phone number, they can easily get yr 2fa to easily setup their phone as a digital token, yr current phone don't even have to disable as digital token first before allowing a new one to be created. So owners don't even realise their phone is no longer the digital token. Once the hackers have signed their device as digital token, then can easily change email and phone number and disable further notifications on their app and you won't even be notified about what they are doing with your account. If they just add 1 more step to do video call via app to verify that you're the owner by showing face and holding up yr ic (like what Singapore Pools require you to do when creating an account) before allowing you to change digital token, it will at least prevent the hackers from setting up their device as Digital token.
