Bank account have portals that one can access online. After entering my uname/password, OTP is sent via SMS to mobile phone. After entering OTP and password again, one is allowed access to online banking portal.
My concern is what happens when phone is lost.
I understand the security concerns using an email associated with the account profile to send OTP. However, if one uses a secondary email, and this secondary email is only used for OTP/2fa, does this alleviate security risk?
There's no benefit to that, because there are already processes in place to resolve the scenario you described.
First, if you lose your phone, you can report it as lost to your carrier and they'll deactivate the SIM to prevent it from being used. At that point, the phone cannot receive new texts to your number. Your carrier will then issue you a new SIM card for your number, which you can use on a new phone. It's the same number, so 2FA is not affected.
If you bought the phone on contract, or you report the phone as stolen, the carrier can also mark the phone's unique identifier (IMEI) as barred, which prevents it from registering to any carrier's cell towers. This has no real bearing on 2FA but it does help limit the impact of a stolen device, especially if you have a passcode on it.
If the 2FA was not via SMS, but through Google Authenticator or a similar app instead, then there should be recovery codes that let you log into your account without the 2FA token, so you can reset your authentication details and recover the account. These recovery codes are shown to you when you set up the 2FA. You should back these recovery codes up somewhere safe, separate to your phone.
If the 2FA solution doesn't have backup codes (e.g. it's done through your bank's mobile app) or you simply lost the backup codes, there's still a recovery process. This varies depending on the organisation or service, but for banks it's almost always as simple as phoning them up and going through alternative security checks to prove that you're the account holder. At that point they can reset your account and let you re-register with a new password and new 2FA.
