Limits of device-bound MFA

Georgia Tech found malware could move money unassisted in 35 of 159 banking apps it tested

The Georgia Tech corpus says the handset belongs to the attacker while Regulation E says the loss belongs to the bank, which makes every extra authentication factor pushed to that same phone a purchase with no yield.