Having read about the ManageMyHealth data leak and the resultant implementation of 2FA with login, it seems clear that with logins/passwords regularly being hacked - users can no longer rely on password secrecy as a fundamental protection against unauthorised access to accounts.  Enter 2FA, which requires a hacker to be able to respond with a 2FA code to get into an account where the password is known.  This is unlikely unless they also have access to the 2FA device.

Accordingly I have concluded that using 2FA at login is not just a financial security issue but a privacy issue.  I am turning on 2FA wherever I have an online account and 2FA is available.

Colour me surprised that I cannot do this with the ANZ app or web logins.  Access is purely with customer number/password on the web or customer number/PIN or fingerprint with the app (and fingerprint is an optional alternative to a PIN, not a PIN replacement).  I questioned the ANZ about this and their response is that the use of Onlinecode is a form of 2FA.  I agreed with them but this protects users against unauthorised funds transfer and is therefore not equivalent to using 2FA at login.  The fact remains that anyone who gets hold of my customer number and password/PIN has access to my data.  This is not a good thing, and 2FA at login is intended to remedy this.

Am I missing something here?  Do the banks have unbreakable password encryption perhaps?