Your fintech is probably not among the 99% accounts GP says don't warrant 'anything fancy'.

IME as a customer/user, financial institutions are some of the worst culprits for doing appalling things in the name of security (theatre) anyway.

Yes, because financial institutions are responsible for losses incurred via account takeover.

And yet no financial institution in Canada supports webauthn hardware tokens - instead choosing to bake their own scheme within their app or use SMS.

And yet they are still out here offering voiceprint authentication

JP Morgan Chase does this, regrettably.

[deleted]