In Sweden, where I live, you can use an app called BankID to identify yourself and sign into official website or sign up official documents. The app uses a 6 digits (numerals, not alphabet or symbols) code as your key. You use it by typing your personal ID number (which is not secret in Sweden, or at least very easy to obtain) into the web site, and than type the 6 digit code into the app on your mobile device or a desktop app as a replay to a pop up with the requesting site's name.
Some banks uses a kind of TOTP devices, like this one for example,. The device uses a 4 digit key as access password. Again you use it by typing your personal ID number into the bank web site, the 4 digit code on the device, and then copying the generated longer OTP.
This is different than traditional login procedures using 2FA since the "something you know" is a very short and simple password. In the bank's case it's only 4 digits, and while I suppose the device would lock itself up if someone would try to guess the password I suppose there's a good (whatever it is) chance to guess it, especially if you obtained some information about it.
Am I getting it wrong ? Is it more secure than that ?