I thought pretty much all UK financial institutions now used 2 FA even when you just want to sign in - or at least online? OTPs needed for bank, share trading sites, CC cos etc just to sign in.
With Lloyds if I try to set up a new payee I have to take a call on a registered number and then input a code that appears on my screen.
No idea about UK phone bank apps however.