I won't install an app on my phone. It probably won't work without Evilcorp Play Framework, it probably won't work with root, and even if neither of those are an issue, I still don't trust my device enough (I won't install banking, password managing, or pgp apps on there, it's too much of a play thing for that). My trusted things are computer-based, not a mobile device that goes everywhere and that I want to be able to use without having to unlock the screen with a complicated password every time.

So it'll probably be SMS, and otherwise they can ship me a second factor -- as the Rabobank already does for as long as I know: they basically send you a payment terminal that creates 0 cent transactions on your card, if I understand it correctly. While a bit annoying, it is safe and not too inconvenient.