[sgxin]

According to the police, Chen had likely clicked on an advertisement in Facebook that downloaded the malware without her knowledge.
...
The hacker first logged into her bank account on July 15, adding a payee to her list to circumvent the alerts that would be created upon transfers being made.

Then on July 18, five transactions took place, including a loan for $20,000. Her total losses amounted to $28,000.
...
Aside from the payee addition, the hackers cleared their tracks by deleting transaction records both in her bank account and in the SMS notifications she would have received.

Her case wouldn't happened if the bank had issued her a hardware token.
Without the latter, the next best option imo will be to use 2 SIM cards, with one installed into a dumb senior phone and dedicated for SMS OTPs and notifications.