> I can’t imagine every bank in a country deciding to make that same move.

Many countries have only three or four full banks (the kind that can give you a Visa or Mastercard bank card, let you send and receive transfers, etc.), and all of them are making the same moves.

https://en.wikipedia.org/wiki/Payment_Services_Directive tldr: eu mandates secure 2fa for online banking and most banks only implement it using their app as second factor.