Add two-factor authentication to the mobile app for desktop website access. Currently your only website account security is a basic password which, once breached it won't matter how strong the security of your mobile app is. Hackers target website access far more often than mobile anyway. My 5 branch local credit union uses 2fa and has stronger website security than your international credit institution. 2fa is a basic and standard feature everywhere now, catch up.