You miss the point: the code will be sent to the phone one is using to enter the password--if one is stupid enough to put financial stuff on their phone. So it is two factors, but stupidly to the same device because they didn't think through the process. No better than password alone.