Regardless of the method used (SMS or authenticator app), enabling 2FA at least for the savings accounts would be a much valued improvement, especially since it would enable savers to have the bunq app (or run the bunq website) on one device while receiving a 2FA code on another. At the moment, once a single device is authenticated, it is possible to make a transfer to any IBAN using the passcode alone, i.e. anyone who gains access to an authenticated device and the passcode can empty the account.