An update to this little rant…and a thought.
UPDATE: The issue was my iOS clock. Google Authenticator uses the local clock to generate the codes and some ToTP 2FA are more generous with their tolerances of old codes being used. I discovered this when using, of all things, the Amazon app to generate an in-store code that helpfully displayed an ‘out-of-sync’ message below the QR code. This led me down a very weird route.
Thought: My informal and highly un-rigorous poll of friends and family gave me pause. 1/12 would NOT have sent in their selfie with a government ID. 11/12 would have refused to spend any significant time on the problem and just “get it over with”. These are people who spend significant time with digital coupons or internet surveys or other things that net them pennies in savings yet the ethics of my refusal were foreign to them. How many future digital hurdles will be circumvented with just a selfie? What about your updated annual income to increase your credit limit? Or verifying your information when calling a utility to change services? Or open an app for the first time? The privacy implications alone are horrifying to me, but I’d rather engage a bank to make a point to a faceless corporation.