How is it that banks implement the most non-standard, sketchiest-feeling MFA login methods again and again?