I understand that - to a certain degree.
But my issue about this is why is it acceptable for us to use the NHS app from a fingerprint login alone, yet needs a code sent to my phone for patient access? When all is considered what is so sensitive about my medical records or prescription requests that makes this extra layer of security necessary for one system but not another? I can see that the extra layer of security might be necessary for members of the Royal Family to deter grubby media intrusion, but in general .... ?
The real problem is that thoughtless and inconsiderate constraints put in place by thoughtless and inconsiderate legal advisors to big organisations results in blatant unnecessary inconvenience to many, bordering on denial of basic access needs. This is a growing problem in so many simple activities. On the odd occasion that a genuine call to me from my bank starts with a simple introduction of themselves, followed by demands that I confirm my identity to them - even though they haven't and can't confirm their identity to me. The last couple of times I've told them I won't play and to write to me and annotate my records that I generally won't take "cold calls".