I have a bank account in one of the main European banks. The bank recently overhauled its online banking system, making it more visually attractive (and also full of bugs and extremely annoying to use).
One of the changes is that the bank now requires my a PIN every time I do an online transaction: they call you on the phone and you have to enter the PIN. By default this PIN is the same as that of the ATM card, I do not know if it can be changed.
How is this advantageous compared to the previous setup, which was similarly a two-factor authentication protocol via phone, but with a One Time Password? I thought this method was secure and reliable. Repeatedly inserting the ATM PIN on the phone for every transaction does not look secure to me: this looks like a regression, not an improvement. Am I wrong?