Sensitive services' OTP to a mobile is not a good idea. Banks should use hardware OTP or other else.
The typical attack vector for OTPs are three types.
Gaining control of the phone
Mobiles, though not so often these days, are easily compromised. Especially, Android applications can freely access the SMS messages(of course with permission).
Exploiting the SMS spam block feature
Most carriers now support automatic spam block, which blocks spam before entering user's phone. Users can log in to the spam control system, set spam numbers, and view spam SMSes.
The attacker uses credientials from breached data, sets the target(ex. bank)'s number as a spam number, and successfully gain OTP data from the spam control system.
One particular vulnerability that has gained popularity with hackers is SIM card fraud. This is basically an attack that essentially dupes your telco into swapping your line of communication to a different SIM card that the hackers have in their possession.
This allows a culprit to take over your phone line. Every time you call your GSM provider with any sensitive request, they’ll ask you for some personal data that helps them identify you as the true owner of the line. This is where hackers come in. Armed with personal information on you, a fraudster has the ability to request a SIM change.