I recently changed banks and the new bank's mobile-banking service has made me ask some questions.
The phone is authenticated/registered with the bank who must be keeping something like an
<IMEI, username> tuple. At this point, all other authentication is done on the phone. So if I need a code to set up a payee, it gets sent via SMS. For other functionality, the app itself generates a code (for example, to log into online banking via desktop browser).
Obviously, in the event of device compromise, multi-factor over 1 channel is not good enough to prevent an attacker from accessing my money!
My previous bank used a cumbersome card reader, so initially the idea of not having to carry that around was appealing, but there is an inherent security improvement there.
How do other banks do this better, in your experience? Or am I blowing the likelihood of such a scenario up to be much more than it actually is?