It's not actual 2FA but 2-step authentication. As linked by StackzOfZtuff they are in fact plain SMS messages.
The reason it's two step and not two factor is because two-factor would imply you need true possession of the object where the token is generated and there has to be assurance the token cannot be intercepted by another party. This is where SMS is flawed. SMS has a few known vulnerabilities which would technically make it possible for interception:
- Compromised GSM network
- False base station attacks on older versions of the GSM protocol
- SIM card cloning
That said the messages are indeed sent using SMS gateways. So is it in fact fool proof way of authentication? Probably not. However each bank does a risk assessment on what the likelihood is of attackers performing the above attacks with the purpose of stealing bank accounts and probably realized the likelihood would be low. It would require a lot of effort in case of SIM cloning or false base station attacks versus the return on investment. If someone manages to compromise a complete cellphone carrier, then there would probably be more valuable attacks to perform than targetting individual bank customers.
Furthermore most banks often require additional confirmation mechanisms to perform actual transactions (but this depends on the bank of course). For instance my bank will not allow me to send transactions to accounts to which I have not sent money before. Otherwise I need to sign the transaction with a card reader.