Why are banks so bad at cybersecurity?

Among all my online accounts, financial institutions seem to be the worst at effective security. They tend to rely on SMS 2FA, even though it has been shown time and again to be the one of the worst 2FA due to the inherent insecurity of SMS. You might get an email option, but again, that doesn't matter if someone already has your credentials or has stolen your identity. There is rarely an option to use an authenticator app, much less …

2fa accounts bad banks cybersecurity email financial financial institutions insecurity institutions security sms