Banks are very good at their online security in comparison to other industries. Most of their security is done where the end user never has to be involved. Reason why most banks still use username and password.
Corporate accounts almost always have a card or physical authenticator. For my personal account there is a third passphrase you must enter the first time you "register" a computer to their service. Even if someone gets my username/password it would only be useful if used from my PC (or one I have authenticated).