That sounds obnoxious they don’t support the usual MFA platforms

And at the same time there’s Fidelity (and others) using voice authentication as the sole verification of account ownership when calling in (I think they finally fixed this a couple years ago)