It's a major issue in South Africa too with bank accounts being raided.

Bank says not my problem if your password got compromised. Cellphone provider says not my problem - SMS was never advertised/intended as secure.

So the user just has to deal with bank account being drained