1strepublicusr

I got a notice from my back (First Republic Bank) that later this year they will require SMS based 2FA.

How can I convince them his is a bad idea? First off the NIST basically declared SMS 2FA insecure. How does a bank not know this? Sim Swaps, social engineering the phone company, etc..

Second, if you travel at all suddenly you can easily have internet access (hotel, cafe, airport) but not have SMS access.

Has anyone had success convincing their bank not to require SMS 2FA?

Requiring 2FA I don't mind. I'd prefer TOTP. I'd put up with email 2FA (Steam does this). But SMS absolutely not!

First Republic Bank is a Bay Area bank so I partly brought this up here hoping there might be enough actual customers here that agree and would be willing to contact the bank and voice your objections.