Recently I had more or less the same discussion with the helpdesk of several banks; a bank has a new mobile app that allows logging in without sending an SMS and without asking a confirmation code by the PIN Sentry/smartcard reader. The discussion is on the following lines:
Q: All your login procedure is in a single mobile app, why did you ditch the two factor authentication?
H: Our app still has two factor authentication
Q: But a login in two steps on the same channnel is still a login through a single channel
H: different answers, but all with arguments in circle that say nothing
Eventually I never had an answer. So I would like to know why a login, which might be in two steps or not, via a mobile app, but without SMS or chipcard is considered a two factor authentication.
Update: I do not think this question is a duplicate of the question asking if the two factor authentication gives a false sense of security
Proposing that as a duplicate is like stating that since the two factor authentication is not enough we can ditch it altogether thus further reducing the security.