Thanks, Pib, understood. I have 2 Factor on all my financial accounts, couldn't login otherwise. Agreed that you have to be very careful in any event.
Phones unfortunately can get malware too. A friend was phished, downloaded malware, and had fairly high amount taken from their account (limit had been increased temporarily to facilitate a particular transaction). People are accustomed to clicking or swiping on anything that comes on their phone, including fake messages containing malware. Unfortunately QR codes can be faked too, and take the user to a site with malware.