@Edent That scam wouldn't work on me: no app. Why can't the bank send each party a GPG-signed and encrypted email with two codes. Each person reads one of them and the other verifies it. A third party shouldn't get the email and can't read it if they did get it.